Identity is a very sensitive area with strict cryptography and compliance requirement regarding password hashing, token signing etc. Then they have to keep upda

Identity is a very sensitive area with strict cryptography and compliance requirement regarding password hashing, token signing etc. Then they have to keep updated with ever changing OAUTH/SAML standards and integration with providers like Facebook/Google etc. They have to get audited and certified like ISO 27001, HiTRUST etc. These are very expensive to manage and high risk for non-tech companies (think banks, insurance, utilities etc.) and hence are outsourced.