From 197682a43eac88ef1bc452254ede09dc87478b1e Mon Sep 17 00:00:00 2001
From: "grafana-delivery-bot[bot]"
 <132647405+grafana-delivery-bot[bot]@users.noreply.github.com>
Date: Thu, 3 Aug 2023 19:14:08 +0300
Subject: [PATCH] [v10.1.x] Auth: lock down Grafana admin sync for SAML
 (#72839)

Auth: lock down Grafana admin sync for SAML (#72828)

lock down Grafana admin sync for SAML

(cherry picked from commit 3a2538c2ca52b65ca0ca966e65b7cbe5654c679e)

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
---
 pkg/services/login/authinfo.go | 2 ++
 pkg/setting/setting.go         | 6 ++++--
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkg/services/login/authinfo.go b/pkg/services/login/authinfo.go
index 5174cbde75e..4bdbf9a740a 100644
--- a/pkg/services/login/authinfo.go
+++ b/pkg/services/login/authinfo.go
@@ -125,6 +125,8 @@ func IsGrafanaAdminExternallySynced(cfg *setting.Cfg, authModule string, oAuthAn
 	switch authModule {
 	case JWTModule:
 		return cfg.JWTAuthAllowAssignGrafanaAdmin
+	case SAMLAuthModule:
+		return cfg.SAMLRoleValuesGrafanaAdmin != ""
 	case LDAPAuthModule:
 		return true
 	default:
diff --git a/pkg/setting/setting.go b/pkg/setting/setting.go
index ba1559dfcbc..dc323df3f19 100644
--- a/pkg/setting/setting.go
+++ b/pkg/setting/setting.go
@@ -515,8 +515,9 @@ type Cfg struct {
 	SecureSocksDSProxy SecureSocksDSProxySettings
 
 	// SAML Auth
-	SAMLAuthEnabled     bool
-	SAMLSkipOrgRoleSync bool
+	SAMLAuthEnabled            bool
+	SAMLSkipOrgRoleSync        bool
+	SAMLRoleValuesGrafanaAdmin string
 
 	// Okta OAuth
 	OktaAuthEnabled     bool
@@ -1261,6 +1262,7 @@ func (cfg *Cfg) readSAMLConfig() {
 	samlSec := cfg.Raw.Section("auth.saml")
 	cfg.SAMLAuthEnabled = samlSec.Key("enabled").MustBool(false)
 	cfg.SAMLSkipOrgRoleSync = samlSec.Key("skip_org_role_sync").MustBool(false)
+	cfg.SAMLRoleValuesGrafanaAdmin = samlSec.Key("role_values_grafana_admin").MustString("")
 }
 
 func (cfg *Cfg) readLDAPConfig() {