And use... who, exactly? Attackers know the identity provider is the foot in the door, so it'll get attacked no matter who you use.