> I've never used it, but they can ban your app token, right? So I assume you need to make sure you're keeping your own up-to-date copy of all claims you have access to.
That's why you should always provide multiple method of authentication.
A simple way is fetching your user email from the OIDC provider, then use it for username/password authn. It's less convenient, but it prevents user from being locked out in case something's wrong with OIDC.
