feature request: How to prevent users without a specific role from signing in to an application (Grafana) in Logto?

[luger1990]

What problem did you meet?

Title: How to prevent users without a specific role from signing in to an application (Grafana) in Logto?

---

Hi Logto team,

I’m integrating Logto with Grafana via OIDC and I want to restrict access based on roles.

My current setup:

• I created a permission resource named grafana
• I created a role grafana-viewer and assigned the grafana permission to it
• User A is assigned the grafana-viewer role
• User B has no grafana-viewer role

In Grafana’s OIDC configuration, I use the following scopes:

scope=openid offline_access grafana roles profile email

However, with this setup:

• Both user A and user B can successfully sign in to Grafana

• I expected that:

  • User A (with grafana-viewer) can sign in
  • User B (without grafana-viewer) should be denied access

It seems that including grafana in the scope only affects what is returned in the token, but does not prevent users without that role from signing in.

My questions:

1. Is scope supposed to control access, or only what claims/permissions are returned in the token?
2. What is the recommended way in Logto to restrict an Application so that only users with a specific role (e.g. grafana-viewer) can sign in?
3. Is this done via Application-level access control (e.g. “Only allow users with specific roles”) rather than via scopes?

I want the authorization to fail during the Logto sign-in flow itself, so that users without the required role cannot complete the login to Grafana at all.

Thanks!

Describe what you'd like Logto to have

I want to disallow someone access one app.

[Lvshujun0918]

I think your feature request is the same as mine. #8173 .However, the member says they won't add such feature since it's an out-of-the-box solution.

[charIeszhao]

Like the other user mentioned above, there's no out-of-the-box solution at this moment. However, if you really want this feature, you can create a feature request on our roadmap.

Another workaround is to implement it yourself, since we offer the ability to fully customize the sign-in experience UI, you can write your customized JS code, checking user credentials against application ID before submitting the sign-in form.