SAML: change the config option for making SAML UI accessible to org Admins (#67399)

* change from role grant overrides to SAML UI specific config option

* update permissions needed to access SAML UI

* PR feedback: change config name, change required perms to write, add a comment

pkg/services/accesscontrol/roles.go

@@ -6,6 +6,7 @@ import (
 	"sync"
 
 	"github.com/grafana/grafana/pkg/services/org"
+	"github.com/grafana/grafana/pkg/setting"
 )
 
 // Roles definition
@@ -191,7 +192,7 @@ var (
 )
 
 // Declare OSS roles to the accesscontrol service
-func DeclareFixedRoles(service Service) error {
+func DeclareFixedRoles(service Service, cfg *setting.Cfg) error {
 	ldapReader := RoleRegistration{
 		Role:   ldapReaderRole,
 		Grants: []string{RoleGrafanaAdmin},
@@ -224,10 +225,15 @@ func DeclareFixedRoles(service Service) error {
 		Role:   usersWriterRole,
 		Grants: []string{RoleGrafanaAdmin},
 	}
+
+	// TODO: Move to own service when implemented
 	authenticationConfigWriter := RoleRegistration{
-		Role:                authenticationConfigWriterRole,
-		Grants:              []string{RoleGrafanaAdmin},
-		AllowGrantsOverride: true,
+		Role:   authenticationConfigWriterRole,
+		Grants: []string{RoleGrafanaAdmin},
+	}
+
+	if cfg.AuthConfigUIAdminAccess {
+		authenticationConfigWriter.Grants = append(authenticationConfigWriter.Grants, string(org.RoleAdmin))
 	}
 
 	return service.DeclareFixedRoles(ldapReader, ldapWriter, orgUsersReader, orgUsersWriter,