Or even just have some non-federated/"local" accounts stored in a vault somewhere you can use when the centralized auth isn't working