We recently had a similar issue and resolved it by disabling the “OpenID Connect match by email” option in the OpenID Connect plugin settings.
The main difference in our case is that we use a self-hosted Authentik instance as SSO, and we have an Authentik webhook that creates a Discourse account for new users once their Authentik account is set up. In this webhook, the Discourse account is created, then added to Discourse groups based on the groups the Authentik account has access to.
Other relevant settings (different from default values) we have in place are:
In Login settings:
- Login required
- Invite only
- Enable local logins (disabled)
- Enable local logins via email (disabled)
- Enable signup CTA (disabled)
- Auth skip create confirm (enabled)
In OpenID Connect plugin settings:
- OpenID Connect authorize scope (email openid profile)
- OpenID Connect match by email (disabled)