# User's Access to Applications

**URL:** <https://community.auth0.com/t/users-access-to-applications/117248>\
**Category:** Get Help\
**Tags:** consent, application\
**Created:** [September 27, 2023, 12:57pm UTC](https://community.auth0.com/t/users-access-to-applications/117248 "2023-09-27T12:57:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aafreen\_Khan](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/aafreen_khan/32/49981_2.png) [@Aafreen\_Khan](https://community.auth0.com/u/Aafreen_Khan)\
**Post date:** [September 27, 2023, 12:57pm UTC](https://community.auth0.com/t/users-access-to-applications/117248/1 "2023-09-27T12:57:21Z")

</div>

Hi community,  
@rueben.tiow @dan.woda @dawid.matuszczyk

I have a question related to the application access control.

According to my understanding all the users can access an application who belong to the connection which is enabled/configured into the application.  
Please let me know if its otherwise.  
My scenario is that i have 2 applications: Application A and Application B.  
And my requirement is that i do not want users of my Application A to be able to access the Application B and vice versa.

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [September 27, 2023, 11:56pm UTC](https://community.auth0.com/t/users-access-to-applications/117248/3 "2023-09-27T23:56:10Z")

</div>

Hey @Aafreen_Khan !

> [@Aafreen\_Khan](#):
>
> According to my understanding all the users can access an application who belong to the connection which is enabled/configured into the application.

This is correct - You could have a separate user store (connection) per application and only enable one for each application.

Alternatively, you could look into using a combination of [RBAC](https://auth0.com/docs/manage-users/access-control/rbac) and [Actions](https://auth0.com/docs/customize/actions). Essentially, in a [Post Login Action](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow) you would want to check a user’s roles (`event.authorization.roles`) and then deny (`api.access.deny`) accordingly.

Lastly, the following docs outlines how to use an allow list based on user emails:

> **[Permit or Deny Login Requests Using Auth0 Actions](https://auth0.com/blog/permit-or-deny-login-requests-using-auth0-actions/)**
>
> This guide shows you how to permit or deny login requests by utilizing deny or allow lists. With step-by-step instructions, you'll create...

---

<div class="post-metadata">

**Author:** ![Aafreen\_Khan](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/aafreen_khan/32/49981_2.png) [@Aafreen\_Khan](https://community.auth0.com/u/Aafreen_Khan)\
**Post date:** [October 11, 2023, 10:14am UTC](https://community.auth0.com/t/users-access-to-applications/117248/4 "2023-10-11T10:14:23Z")

</div>

Hi @ty.frith

Thanks a lot for your suggestions.  
we have tried the second method suggested by you to “Permit or Deny login Requests using Auth0 Actions” and it worked. However, we have used Rules as of now instead of Action.  
Now the only question remains related to this is:  
We need to provide a list of whitelisted email ids of the users whom we want to authorize to a particular application. This is basically hardcoding these email ids into the Rule/Action.  
example: const whitelist = [‘xyz@abc.com’];  
Is there any way to automate this/ remove the need of this hardcoding of emails into a list?  
as it is also cumbersome as every time, we integrate a new app or add a new user to the app we will have to make changes in the Rule/Action code.

The code we have used in the rule is as below:

function userWhitelistForSpecificApp(user, context, callback) {  
if (!user.email || !user.email\_verified) {  
return callback(new UnauthorizedError(‘Access denied.’));  
}

//Application 1

if (context.clientName !== ‘XYZ’) {  
return callback(null, user, context);  
}

const whitelist = [‘xyz@abc.com’]; // authorized users  
const userHasAccess = whitelist.some(function (email) {  
return email === user.email;  
});

if (!userHasAccess) {  
return callback(new UnauthorizedError(‘Access denied.’));  
}

//Applicaton 2

if (context.clientName !== ‘XYZ1’) {  
return callback(null, user, context);  
}

const whitelistAP = [‘abc@xyz.com’]; // authorized users  
const userHasAccessAP = whitelist.some(function (email) {  
return email === user.email;  
});

if (!userHasAccessAP) {  
return callback(new UnauthorizedError(‘Access denied.’));  
}

callback(null, user, context);  
}

Also the other method suggested by you to use the combination of RBAC and Actions is unfortunately still not that clear for us to try it.  
Can you help us with a reference in the doc or shed some more light over it in a bit of details?

Waiting patiently.

Thanks and Regards,  
Aafreen

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [October 25, 2023, 10:14am UTC](https://community.auth0.com/t/users-access-to-applications/117248/5 "2023-10-25T10:14:55Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.