What are the implications of customizing the IdentityTypeDefinition in identity config? We have different types than are listed there so we want to add a few more options, and we also want certifier for Service Accounts to be Manager, not administrator.