@@ -53,6 +53,7 @@ type Provider struct {
 	OriginalAuthURL string `json:"-"`
 	AuthURL         string `json:"auth_url"`
 	LogoutURL       string `json:"logout_url"`
+	Domain          string `json:"domain"`

@@ -192,2 +193,4 @@
 	}
 
+	//Check is the email address is at the domain configured for the provider, and return the error if not
+	if provider.Domain != "" && !strings.HasSuffix(cl.Email, provider.Domain) {

@@ -427,4 +427,2 @@
 }
 
-// ErrNoOpenIDEmailProvided represents a "NoEmailProvided" kind of error.
-type ErrOpenIDCustomScopeMalformed struct {

@@ -534,1 +508,4 @@
 }
+
+// ErrOpenIDCustomScopeMalformed represents a "ErrOpenIDCustomScopeMalformed" kind of error.
+type ErrOpenIDCustomScopeMalformed struct {

@@ -194,0 +197,4 @@
+		splitEmail := strings.Split(cl.Email, "@")
+		foundGoodDomain := false
+		for domain, _ := range provider.Domains {
+			if strings.HasSuffix(splitEmail[len(splitEmail) -1], provider.Domains[domain]) {

@@ -125,6 +125,11 @@ func getProviderFromMap(pi map[string]interface{}) (provider *Provider, err erro
 		logoutURL = ""
 	}
 
+	domains, ok := pi["domains"].(string)

@@ -535,0 +534,4 @@
+}
+
+// ErrOpenIDEmailBadDomain represents a "OpenIDEmailBadDomain" kind of error.
+type ErrOpenIDEmailBadDomain struct {

@@ -325,0 +325,4 @@
+        # The list of e-mail domains that will be allowed to authenticate using OpenID Connect. If empty, any domain is allowed.
+        # Use this only if you want to restrict which users are allowed to authenticate using OpenID Connect.
+        domains:
+            - example.com

@@ -194,0 +196,4 @@
+	if len(provider.Domains) > 0 {
+		foundGoodDomain := false
+		for domain := range provider.Domains {
+			if strings.HasSuffix(cl.Email, "@"+provider.Domains[domain]) {

@@ -535,0 +535,4 @@
+
+// ErrOpenIDEmailBadDomain represents a "OpenIDEmailBadDomain" kind of error.
+type ErrOpenIDEmailBadDomain struct {
+	Email string