Auth: Make domain_hint configurable for the Azure AD/Entra ID connector (#108061)

* Make domain_hint configurable for Entra ID/Azure AD

* Add docs

* Fix + i18n gen

* Add validation to domain hint

* Remove unnecessary change

pkg/services/ssosettings/validation/oauth_validators.go

@@ -3,6 +3,7 @@ package validation
 import (
 	"fmt"
 	"net/url"
+	"regexp"
 	"slices"
 	"strings"
 
@@ -11,6 +12,8 @@ import (
 	"github.com/grafana/grafana/pkg/services/ssosettings"
 )
 
+var domainRegexp = regexp.MustCompile(`^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*\.[a-zA-Z]{2,6}$`)
+
 func AllowAssignGrafanaAdminValidator(info *social.OAuthInfo, oldInfo *social.OAuthInfo, requester identity.Requester) ssosettings.ValidateFunc[social.OAuthInfo] {
 	return func(info *social.OAuthInfo, requester identity.Requester) error {
 		hasChanged := info.AllowAssignGrafanaAdmin != oldInfo.AllowAssignGrafanaAdmin
@@ -66,6 +69,18 @@ func UrlValidator(value string, name string) ssosettings.ValidateFunc[social.OAu
 	}
 }
 
+func DomainValidator(value string, name string) ssosettings.ValidateFunc[social.OAuthInfo] {
+	return func(info *social.OAuthInfo, requester identity.Requester) error {
+		if value == "" {
+			return nil
+		}
+		if !domainRegexp.MatchString(value) {
+			return ssosettings.ErrInvalidOAuthConfig(fmt.Sprintf("%s contains an invalid domain.", name))
+		}
+		return nil
+	}
+}
+
 func RequiredUrlValidator(value string, name string) ssosettings.ValidateFunc[social.OAuthInfo] {
 	return func(info *social.OAuthInfo, requester identity.Requester) error {
 		if err := RequiredValidator(value, name)(info, requester); err != nil {