Signing In with OAuth2

How can a staff member at Riverside Hall sign in to the booking service if the booking service never sees that person's password?

Venue staff create events through a few web pages that the booking service serves under /staff. The venue already runs an identity provider, a service that holds staff accounts and checks their passwords for every internal tool. A second password in the booking service would be one more secret to leak and one more account to close when someone leaves.