SAML: change the config option for making SAML UI accessible to org Admins (#67399)

* change from role grant overrides to SAML UI specific config option

* update permissions needed to access SAML UI

* PR feedback: change config name, change required perms to write, add a comment

pkg/services/accesscontrol/acimpl/service.go

@@ -36,7 +36,7 @@ func ProvideService(cfg *setting.Cfg, store db.DB, routeRegister routing.RouteRe
 
 	if !accesscontrol.IsDisabled(cfg) {
 		api.NewAccessControlAPI(routeRegister, accessControl, service, features).RegisterAPIEndpoints()
-		if err := accesscontrol.DeclareFixedRoles(service); err != nil {
+		if err := accesscontrol.DeclareFixedRoles(service, cfg); err != nil {
 			return nil, err
 		}
 	}
@@ -166,12 +166,7 @@ func (s *Service) DeclareFixedRoles(registrations ...accesscontrol.RoleRegistrat
 		return nil
 	}
 
-	for i := range registrations {
-		r := registrations[i]
-		if r.AllowGrantsOverride {
-			s.handleGrantOverrides(&r)
-		}
-
+	for _, r := range registrations {
 		err := accesscontrol.ValidateFixedRole(r.Role)
 		if err != nil {
 			return err
@@ -188,15 +183,6 @@ func (s *Service) DeclareFixedRoles(registrations ...accesscontrol.RoleRegistrat
 	return nil
 }
 
-func (s *Service) handleGrantOverrides(r *accesscontrol.RoleRegistration) {
-	// Replace ":" and "." with "_" to match the key in the config
-	key := strings.ReplaceAll(strings.ReplaceAll(r.Role.Name, ":", "_"), ".", "_")
-	if overrides, ok := s.cfg.RBACGrantOverrides[key]; ok {
-		r.Grants = overrides
-		s.log.Info("Overriding grants for role", "role", r.Role.Name, "overrides", overrides)
-	}
-}
-
 // RegisterFixedRoles registers all declared roles in RAM
 func (s *Service) RegisterFixedRoles(ctx context.Context) error {
 	// If accesscontrol is disabled no need to register roles