# Disable role option in oidc login

**URL:** <https://discuss.hashicorp.com/t/disable-role-option-in-oidc-login/68933>\
**Category:** Vault\
**Tags:** vault\
**Created:** [July 30, 2024, 11:01am UTC](https://discuss.hashicorp.com/t/disable-role-option-in-oidc-login/68933 "2024-07-30T11:01:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![BANZAINAM](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/banzainam/32/42448_2.png) [@BANZAINAM](https://discuss.hashicorp.com/u/BANZAINAM)\
**Post date:** [July 30, 2024, 11:01am UTC](https://discuss.hashicorp.com/t/disable-role-option-in-oidc-login/68933/1 "2024-07-30T11:01:14Z")

</div>

Hello.

I am trying to login to Vault login using OIDC. I try in production server.  
When trying to login via CLI, the role can be specified arbitrarily by the end user as follows.  
‘’’  
vault login -method=oidc role=“reader”  
‘’’

In this case, as long as the user knows the role name, he/she can access information using a role that is assigned a policy with higher privileges than his/her own.

Is it possible to disable the option “role” in the above login command with OIDC?

Note that a similar question was asked in the past but no clear solution was provided.

> [@Vault UI OIDC login, Roles Text Box](https://discuss.hashicorp.com/t/vault-ui-oidc-login-roles-text-box/13383):
>
> Hi there, Is it possible to disable or remove the Roles text box from the OIDC login form? When a user is presented with this, they are able to enter any role that exists within Vault and thus escalate the level of their access. A simple example would for a user with access to Role-A could extend their access by putting in the text box Role-B. By doing this gaining access to path secrets/B without authorisation. The work around at this time seems to me to be to have a set of anti-roles wher…

Best regards

---

<div class="post-metadata">

**Author:** ![Joffrey](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/joffrey/32/24702_2.png) [@Joffrey](https://discuss.hashicorp.com/u/Joffrey)\
**Post date:** [July 31, 2024, 10:18am UTC](https://discuss.hashicorp.com/t/disable-role-option-in-oidc-login/68933/2 "2024-07-31T10:18:45Z")

</div>

You can set default role in oidc configuration and you can let the role textbox empty.

If you want limit who can use which role, you must configure bound\_audience in your role. Each key in the array must match keys in the OIDC token. For example, you can use “aud” or “sub”.