Somehow I missed this statement in the document I posted:

Keycloak requires the sub claim in the assertion to be the user identifier in the external provider. The Keycloak user should be previously linked to the Identity Provider. This way there is a link between the external and the internal user ID.

Which I guess answers my initial question. Is there anyway that the linking of the user and the keycloak user can be automated?

I have the same problem. Does it only work right now if we link all users manually?

It would seem that this is the case, and that the change is intentional:

//user must exist in keycloak

Further to this it also seems that if the user does already exist, then the federated identity is not imported into Keycloak meaning that the external IDP cannot be the single source of truth for roles and groups when authenticating solely using this method.

it does look like importing a federated identity is supported in the external to internal token exchange provider:

UserModel user = importUserFromExternalIdentity(context);

However, this is currently an experimental feature (not even preview), and it is not clear to me exactly how this would interact with the 'JWT Authorization Grant'.

I face the same. If any solutions for this

Same here. Maybe there are already security concerns we don't know?

To import external users into Keycloak with JWT Authorization Grant, we extended JWTAuthorizationGrantIdentityProvider and implemented custom logic in validateAuthorizationGrantAssertion to create the user programmatically if it does not already exist. Not the prettiest solution, but it works.