# Restrict logins via OIDC to specific roles

**URL:** <https://meta.discourse.org/t/restrict-logins-via-oidc-to-specific-roles/340389>\
**Category:** SSO\
**Created:** [December 4, 2024, 3:39pm UTC](https://meta.discourse.org/t/restrict-logins-via-oidc-to-specific-roles/340389 "2024-12-04T15:39:35Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![IanManning](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/ianmanning/32/433880_2.png) [@IanManning](https://meta.discourse.org/u/IanManning)\
**Post date:** [December 4, 2024, 3:39pm UTC](https://meta.discourse.org/t/restrict-logins-via-oidc-to-specific-roles/340389/1 "2024-12-04T15:39:35Z")

</div>

Hi  
I’ve connected my Discourse instance to our identity provider, SAP CDC, using the OIDC plugin.  
This works in the sense that users can login via their SAP CDC accounts and register on discourse.  
I want to be able to restrict the ability to get to discourse to a subset of the users in SAP CDC. These are defined by roles based through in the JWT - can someone help me with how to configure discourse to reject users who don’t have the specific roles?

Ian

---

_[View the full topic](https://meta.discourse.org/t/restrict-logins-via-oidc-to-specific-roles/340389)._