def METHOD_NAME(obj: AuthIdentity) -> Status:
    if not obj.auth_provider.flags.allow_unlinked:
        return Status.NEEDED_FOR_ORG_AUTH
    elif has_password or global_login_id_count > 0:
        return Status.CAN_DISCONNECT
    else:
        # Assume the user has only this AuthIdentity as their
        # means of logging in. (They might actually have two or
        # more from non-SSO-requiring orgs, but that's so rare
        # and weird that we don't care.)
        return Status.NEEDED_FOR_GLOBAL_AUTH