Can enterprises safely use open-source in their identity management tech?