http: local-login rejects auth_source='oidc' users

internal/server/http/auth.go

@@ -56,6 +56,9 @@ func (s *Server) authenticateAndSession(w stdhttp.ResponseWriter, r *stdhttp.Req
 		// existence to a probing attacker.
 		return nil, errInvalidCredentials
 	}
+	if u.AuthSource == "oidc" {
+		return nil, errInvalidCredentials
+	}
 	if err := auth.VerifyPassword(u.PasswordHash, password); err != nil {
 		return nil, errInvalidCredentials
 	}