Ory Kratos does not provide a built-in mechanism to deduplicate the subject (sub) across multiple OIDC providers during sign-in. The system treats each OIDC provider as a separate entity, and the uniqueness constraint is enforced on the identifier (such as email) across all providers. If two different OIDC providers return the same email or subject, Kratos will block the second sign-in attempt and prompt the user to confirm with the original provider. There is no supported way to automatically deduplicate or merge these identities during sign-in [kratos, login with different oidc providers, with same email address](
https://github.com/ory/kratos/discussions/4162). The only workaround mentioned is to use separate Ory projects or instances, but this is not documented or officially supported. Therefore, if deduplication of subjects across providers is a strict requirement, Ory Kratos does not currently support this scenario out of the box, and the knowledge sources do not provide a recommended solution.