With these servers/services you can usually chain to another identity source (e.g. ldap directory+kerberos) so that would fall to the origin identity service. B

With these servers/services you can usually chain to another identity source (e.g. ldap directory+kerberos) so that would fall to the origin identity service. But even if you don't chain it the owner of OIDC provider will usually provide an administrator role and integration system accounts that can be used as an out of band sort of user account recovery mechanism.