diff --git a/pkg/login/social/gitlab_oauth.go b/pkg/login/social/gitlab_oauth.go
index 17bd231e1a4..f169c6a8a03 100644
--- a/pkg/login/social/gitlab_oauth.go
+++ b/pkg/login/social/gitlab_oauth.go
@@ -2,6 +2,7 @@ package social
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/http"
 	"regexp"
@@ -13,9 +14,10 @@ import (
 
 type SocialGitlab struct {
 	*SocialBase
-	allowedGroups     []string
-	apiUrl            string
-	roleAttributePath string
+	allowedGroups       []string
+	apiUrl              string
+	roleAttributePath   string
+	roleAttributeStrict bool
 }
 
 func (s *SocialGitlab) Type() int {
@@ -119,6 +121,9 @@ func (s *SocialGitlab) UserInfo(client *http.Client, token *oauth2.Token) (*Basi
 	if err != nil {
 		s.log.Error("Failed to extract role", "error", err)
 	}
+	if s.roleAttributeStrict && !models.RoleType(role).IsValid() {
+		return nil, errors.New("invalid role")
+	}
 
 	userInfo := &BasicUserInfo{
 		Id:     fmt.Sprintf("%d", data.Id),
diff --git a/pkg/login/social/social.go b/pkg/login/social/social.go
index 899716b3741..77e1def01ff 100644
--- a/pkg/login/social/social.go
+++ b/pkg/login/social/social.go
@@ -130,10 +130,11 @@ func ProvideService(cfg *setting.Cfg) *SocialService {
 		// GitLab.
 		if name == "gitlab" {
 			ss.socialMap["gitlab"] = &SocialGitlab{
-				SocialBase:        newSocialBase(name, &config, info),
-				apiUrl:            info.ApiUrl,
-				allowedGroups:     util.SplitString(sec.Key("allowed_groups").String()),
-				roleAttributePath: info.RoleAttributePath,
+				SocialBase:          newSocialBase(name, &config, info),
+				apiUrl:              info.ApiUrl,
+				allowedGroups:       util.SplitString(sec.Key("allowed_groups").String()),
+				roleAttributePath:   info.RoleAttributePath,
+				roleAttributeStrict: info.RoleAttributeStrict,
 			}
 		}