There was new authenticator Confirm override existing link added. This authenticator allows to override linked IDP username for the Keycloak user, which was already linked to differentIDP identity before. More details in the Server Administration Guide. Thanks to Lex Cao for the contribution.