Context

I use an external IdP for domain-based SSO (Organization, domain orga.com).

The Keycloak login page is skipped entirely: we pass kc_idp_hint=<idp-alias> as a parameter in the authorization request, so the user is redirected straight to the external IdP without ever seeing the Keycloak username form.

When a user logs in through this IdP and a local account already exists with the same email, the First Broker Login flow offers to link the two accounts by email (the Verify Existing Account by Email step).

What works

For an enabled account: everything works, the linking email is sent and the account is linked.

The problem

When the existing local account is disabled (enabled = false):

• no verification email is sent;
• no error message is shown;
• the user stays stuck indefinitely on the linking page.

Note that because of the kc_idp_hint redirect, the user never goes through the standard login page, which is where Keycloak would normally display the "Account is disabled" error. Instead, they land directly on the account-linking page, where the disabled state fails silently.

My questions

• Is it intended behavior to refuse linking a disabled account?
• If so, how can I make Keycloak show a clear error ("account disabled") instead of silently hanging, given that the login page (and its error display) is bypassed by kc_idp_hint?

Environment

• Keycloak version: 26.4.2

Thank you for your help