reading RFC3414 / APPENDIX A / A.1 SNMP engine installation parameters,
there is a template user in the usmUserTable with auth. and privacy
support (MD5 and DES) enabled shown.

Just for clarification, is it possible to clone a new user from this one
but setting the auth. protocol to SHA? I think this should not be
possible but i'm not sure.

The usmUserAuthProtocol object in RFC3414 states:

"... once instantiated, the value of such an instance of
this object can only be changed via a set operation to
the value of the usmNoAuthProtocol.
If a set operation tries to change the value of an
existing instance of this object to any value other
than usmNoAuthProtocol, then an 'inconsistentValue'
error must be returned ..."

Markus Seehofer