From 5a2ab9b8b0fc19a3d8e578dbbfee3899278a67ff Mon Sep 17 00:00:00 2001
From: "grafana-delivery-bot[bot]"
 <132647405+grafana-delivery-bot[bot]@users.noreply.github.com>
Date: Fri, 19 Sep 2025 10:46:31 -0500
Subject: [PATCH] [release-12.2.1] Auth: Add SCIM settings permission to auth
 config writer role (#111398)

Auth: Add SCIM settings permission to auth config writer role (#111326)

* Auth: add SCIM settings permission to authentication config writer role

* make update-workspace

(cherry picked from commit 1ef27e97499d1c3757051cfe36dbcd318743b3b6)

Co-authored-by: colin-stuart <colindonstuart@gmail.com>
---
 pkg/services/accesscontrol/models.go | 1 +
 pkg/services/accesscontrol/roles.go  | 8 ++++++++
 2 files changed, 9 insertions(+)

diff --git a/pkg/services/accesscontrol/models.go b/pkg/services/accesscontrol/models.go
index dc12171eaa5..2afc2a9e935 100644
--- a/pkg/services/accesscontrol/models.go
+++ b/pkg/services/accesscontrol/models.go
@@ -401,6 +401,7 @@ const (
 	// Settings scope
 	ScopeSettingsAll  = "settings:*"
 	ScopeSettingsSAML = "settings:auth.saml:*"
+	ScopeSettingsSCIM = "settings:auth.scim:*"
 
 	// Team related actions
 	ActionTeamsCreate           = "teams:create"
diff --git a/pkg/services/accesscontrol/roles.go b/pkg/services/accesscontrol/roles.go
index 6ed0357d9de..6d01e3b8624 100644
--- a/pkg/services/accesscontrol/roles.go
+++ b/pkg/services/accesscontrol/roles.go
@@ -273,6 +273,14 @@ var (
 				Action: ActionSettingsWrite,
 				Scope:  ScopeSettingsOAuth("ldap"),
 			},
+			{
+				Action: ActionSettingsRead,
+				Scope:  ScopeSettingsSCIM,
+			},
+			{
+				Action: ActionSettingsWrite,
+				Scope:  ScopeSettingsSCIM,
+			},
 		},
 	}