Hey Coders, I have set up the OpenID Connect for signing in to Coder and anybody with an account from my domain can log in. I wanted to know if there's a way to be able to control that via Cloud IAM? On GCP, for instance?

hey @Dandi, I'm unfamiliar with IAM, could you maybe describe a bit more?

Hey @Phorcys not exactly with a specific domain but with a specific role within that domain? So IAM allows you to create roles and assign them to different users. Is there a way to extend that so that Coder would check the roles first and if approved would grant access?

I don't know, let me look

Yeah, there are a few options: - Leverage group sync to allow any user from your identity provider to log in, but restrict which groups can access templates - Change your "client" in your identify provider to restrict access to what groups can log in. This has nothing to do with Coder, but can prevent log-ins from unauthorized groups - Use

OIDC_EMAIL_DOMAIN

to restrict logins to users on specific groups. We don't plan on adding a first-class feature in Coder to restrict sign-in by group. We may add a feature where you can disable signups overall and manually add OIDC users. Hope that helps!