Auth is a bit of a different beast when it comes to the build vs buy debate though. A competent auth provider has the infrastructure (and necessary data) to deflect against DDoS attacks, bots, etc.