I’ve set up two IDPs (Google and Facebook, for now) on Keycloak and I’m using them for exchanging their access tokens for internal ones provided by Keycloak running on my machine.
Both integrations behave as expected but the problem that I currently have is that Keycloak refuses to automatically link another identity provider if the user was already created (in Keycloak’s database) previously, through another identity provider.

What I mean is that if I log in using Google’s IDP, a new user is created (as expected), then log out and then try logging in with Facebook’s IDP (same e-mail address, treated also as a username) Keycloak complains that the user already exists (or vice versa, first Facebook then Google).
I can manually link another IDP to an existing user using the Admin UI but I’d like this process to be automated.

I’m obtaining the internal tokens (access and refresh) via a HTTP call from my backend to the openid-connect/token Keycloak’s endpoint where the grant_type parameter is defined as urn:ietf:params:oauth:grant-type:token-exchange. I’m also defining the subject_issuer, subject_token and subject_token_type parameters, of course.

Manual linking, after which Keycloak stops complaining that a user already exists:

I’ve tried adding a custom authentication flow for the two configured IDPs but to no avail:

Is it even possible to automate this linking process? Thank you in advance.