Auth: Improve /admin/authentication permission checks and include new SSO pages (#81183)

* Move evalAuthSettings to ssoutils

* Improve permission check for auth page

pkg/services/accesscontrol/ssoutils/utils.go

@@ -0,0 +1,24 @@
+package ssoutils
+
+import (
+	ac "github.com/grafana/grafana/pkg/services/accesscontrol"
+	"github.com/grafana/grafana/pkg/setting"
+)
+
+func EvalAuthenticationSettings(cfg *setting.Cfg) ac.Evaluator {
+	return ac.EvalAny(
+		ac.EvalAll(
+			ac.EvalPermission(ac.ActionSettingsWrite, ac.ScopeSettingsSAML),
+			ac.EvalPermission(ac.ActionSettingsRead, ac.ScopeSettingsSAML),
+		),
+		ac.EvalPermission(ac.ActionLDAPStatusRead))
+}
+
+func OauthSettingsEvaluator(cfg *setting.Cfg) ac.Evaluator {
+	result := make([]ac.Evaluator, 0, len(cfg.SSOSettingsConfigurableProviders))
+	for provider := range cfg.SSOSettingsConfigurableProviders {
+		result = append(result, ac.EvalPermission(ac.ActionSettingsRead, ac.ScopeSettingsOAuth(provider)))
+		result = append(result, ac.EvalPermission(ac.ActionSettingsWrite, ac.ScopeSettingsOAuth(provider)))
+	}
+	return ac.EvalAny(result...)
+}

pkg/services/navtree/navtreeimpl/admin.go

@@ -2,6 +2,7 @@ package navtreeimpl
 
 import (
 	ac "github.com/grafana/grafana/pkg/services/accesscontrol"
+	"github.com/grafana/grafana/pkg/services/accesscontrol/ssoutils"
 	contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
 	"github.com/grafana/grafana/pkg/services/correlations"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
@@ -80,7 +81,8 @@ func (s *ServiceImpl) getAdminNode(c *contextmodel.ReqContext) (*navtree.NavLink
 		})
 	}
 
-	if (authConfigUIAvailable && hasAccess(evalAuthenticationSettings())) || s.features.IsEnabled(ctx, featuremgmt.FlagSsoSettingsApi) {
+	if authConfigUIAvailable && hasAccess(ssoutils.EvalAuthenticationSettings(s.cfg)) ||
+		(hasAccess(ssoutils.OauthSettingsEvaluator(s.cfg)) && s.features.IsEnabled(ctx, featuremgmt.FlagSsoSettingsApi)) {
 		configNodes = append(configNodes, &navtree.NavLink{
 			Text:     "Authentication",
 			Id:       "authentication",
@@ -150,10 +152,3 @@ func enableServiceAccount(s *ServiceImpl, c *contextmodel.ReqContext) bool {
 	hasAccess := ac.HasAccess(s.accessControl, c)
 	return hasAccess(serviceaccounts.AccessEvaluator)
 }
-
-func evalAuthenticationSettings() ac.Evaluator {
-	return ac.EvalAny(ac.EvalAll(
-		ac.EvalPermission(ac.ActionSettingsWrite, ac.ScopeSettingsSAML),
-		ac.EvalPermission(ac.ActionSettingsRead, ac.ScopeSettingsSAML),
-	), ac.EvalPermission(ac.ActionLDAPStatusRead))
-}