One of the key features to making this work is the attack protection features these services have. Okta, Azure, Auth0 all have this. Is there an open source alternative? Seems like we would need a service, like SPAMCOP is for email, to make it work.