Hey Freddy,

I do not completely understand your question. Are applications A, B, and C external applications or IAM applications?

If you want to give users access to IAM applications, this document may help: https://docs.thinkwisesoftware.com/docs/iam/openid_provisioning
You can create various user groups to give access to different applications. Then set up provisions to decide to which user group a user belongs. 

Hi Ester, 

Don't think that's what I am looking for. Let me try to explain better. There is an application that manages clients, suppliers, partners, etc.. Let's call it A. What we would like to achieve is using the application (incl. IAM) as an OpenID provider to give access to supporting applications. 

There is a projectmanagement application (B), that uses OIDC of A to authenticate. And there is a documentation application (C) that also uses OIDC of A to authenticate. What I am trying to accomplish is that from A I can say person x, y and z from client 1 and 2 can access application B.  But not C. But person y from client 6 can access both applications B and C. 

All users have access to A with their proper roles.