only run identity providers if refreshing metadata