Limit OIDC provider to certain users

[WolfSkin0]

I have a collection of "standard" and "administrative" users in the same ORY instance, and I would like to have "administrative" users be able to access certain 3rd-party services via OIDC without allowing any "standard" users to do so.
Is there a way to achieve this in ORY, or at least a different piece of software that I can use as middleware to do that, as I would like to avoid fracturing where I store user accounts in order to make this work.

[vinckr]

Hello @WolfSkin0
Is this what you are looking for: https://www.ory.sh/docs/kratos/organizations/ ?

[WolfSkin0]

Unfortunately I'm not looking for SSO login to ORY, but rather have the Hydra OIDC provider functionality be limitable to certain users that are already registered in ORY via a filter of sorts. I.e. I have users A and B in ORY, and I want user A to be able to login to a different application using ORY Hydra as the OpenID provider, but not let user B be able to do it.

[vinckr]

How should that look from the UX perspective?
Maybe you can maybe block the request and show an error in your frontend, whatever you are using to handle that?
Are you using Ory Kratos/Ory Identities as well?

[WolfSkin0]

For some more context, since I don't think we're on the same page here:
I'm using ORY SaaS, and I'm trying to have only certain users in my instance be able to login to mailcow via the OIDC provider.
I cannot do any checks on mailcow's side for whether a user is allowed to login or not (as far as I can tell) as it just assumes that anyone logging in via OIDC is authorised, and I'm currently not in a position to make extensive changes to mailcow's logic to make this possible.
As such, I am looking for a way to handle the logic on ORY's side (i.e. by applying some sort of filter when a user attempts to login via ORY that checks if the user is even allowed to use the OIDC provider or not), rather than having to maintain multiple instances and synchronise user accounts between them.

In terms of UX, I imagine integrating with Keto might work? Since then it should be possible to just treat it as another relationship tuple. But I'm not sure how that would work in the wider ORY OSS ecosystem, since tightly coupling Keto in might not be wanted?