When “Disable Local Authentication” is turned on, password field still shows

[jakeparis]

When we turn on the Disable Local Authentication setting, and visit our siteurl.com/wp-login.php page, the shib button shows as expected, but the WordPress password field still shows up. That is confusing to say the least.

I’m using WordPress 5.7.2.

It looks like the default login input fields are being hidden with some css:

.login #loginform p {
      display: none;
}

But the password is not in a <p>. Its markup is like this:

<div class="user-pass-wrap">
    <label for="user_pass">Password</label>
    <div class="wp-pwd">
        <input type="password" name="pwd" id="user_pass" class="input password-input" value="" size="20">
        <button type="button" class="button button-secondary wp-hide-pw hide-if-no-js" data-toggle="0" aria-label="Show password">
            <span class="dashicons dashicons-visibility" aria-hidden="true"></span>
        </button>
    </div>
</div>