Auth: Remove ssoSettingsApi feature toggle (#107528)

* Remove ssoSettingsApi feature toggle

* Clean up

* lint

* Fix tests

pkg/services/authn/authnimpl/registration.go

@@ -58,8 +58,7 @@ func ProvideRegistration(
 	var passwordClients []authn.PasswordClient
 
 	// always register LDAP if LDAP is enabled in SSO settings
-	ssoSettingsLDAP := features.IsEnabledGlobally(featuremgmt.FlagSsoSettingsApi) && features.IsEnabledGlobally(featuremgmt.FlagSsoSettingsLDAP)
-	if cfg.LDAPAuthEnabled || ssoSettingsLDAP {
+	if cfg.LDAPAuthEnabled || features.IsEnabledGlobally(featuremgmt.FlagSsoSettingsLDAP) {
 		ldap := clients.ProvideLDAP(cfg, ldapService, userService, authInfoService)
 		proxyClients = append(proxyClients, ldap)
 		passwordClients = append(passwordClients, ldap)

pkg/services/featuremgmt/registry.go

@@ -651,15 +651,6 @@ var (
 			FrontendOnly: false,
 			Owner:        grafanaOperatorExperienceSquad,
 		},
-		{
-			Name:           "ssoSettingsApi",
-			Description:    "Enables the SSO settings API and the OAuth configuration UIs in Grafana",
-			Stage:          FeatureStageGeneralAvailability,
-			Expression:     "true",
-			AllowSelfServe: true,
-			FrontendOnly:   false,
-			Owner:          identityAccessTeam,
-		},
 		{
 			Name:         "canvasPanelPanZoom",
 			Description:  "Allow pan and zoom in canvas panel",

pkg/services/featuremgmt/toggles_gen.csv

@@ -86,7 +86,6 @@ dashboardScene,GA,@grafana/dashboards-squad,false,false,true
 dashboardNewLayouts,experimental,@grafana/dashboards-squad,false,false,true
 panelFilterVariable,experimental,@grafana/dashboards-squad,false,false,true
 pdfTables,preview,@grafana/grafana-operator-experience-squad,false,false,false
-ssoSettingsApi,GA,@grafana/identity-access-team,false,false,false
 canvasPanelPanZoom,preview,@grafana/dataviz-squad,false,false,true
 logsInfiniteScrolling,GA,@grafana/observability-logs,false,false,true
 logRowsPopoverMenu,GA,@grafana/observability-logs,false,false,true

pkg/services/featuremgmt/toggles_gen.go

@@ -355,10 +355,6 @@ const (
 	// Enables generating table data as PDF in reporting
 	FlagPdfTables = "pdfTables"
 
-	// FlagSsoSettingsApi
-	// Enables the SSO settings API and the OAuth configuration UIs in Grafana
-	FlagSsoSettingsApi = "ssoSettingsApi"
-
 	// FlagCanvasPanelPanZoom
 	// Allow pan and zoom in canvas panel
 	FlagCanvasPanelPanZoom = "canvasPanelPanZoom"

pkg/services/featuremgmt/toggles_gen.json

@@ -2839,7 +2839,8 @@
       "metadata": {
         "name": "ssoSettingsApi",
         "resourceVersion": "1750434297879",
-        "creationTimestamp": "2023-11-08T09:50:01Z"
+        "creationTimestamp": "2023-11-08T09:50:01Z",
+        "deletionTimestamp": "2025-07-02T14:16:57Z"
       },
       "spec": {
         "description": "Enables the SSO settings API and the OAuth configuration UIs in Grafana",

pkg/services/ldap/service/ldap.go

@@ -56,7 +56,7 @@ func ProvideService(cfg *setting.Cfg, features featuremgmt.FeatureToggles, ssoSe
 		ssoSettings:  ssoSettings,
 	}
 
-	if s.features.IsEnabledGlobally(featuremgmt.FlagSsoSettingsApi) && s.features.IsEnabledGlobally(featuremgmt.FlagSsoSettingsLDAP) {
+	if s.features.IsEnabledGlobally(featuremgmt.FlagSsoSettingsLDAP) {
 		s.ssoSettings.RegisterReloadable(social.LDAPProviderName, s)
 
 		ldapSettings, err := s.ssoSettings.GetForProvider(context.Background(), social.LDAPProviderName)

pkg/services/ldap/service/ldap_test.go

@@ -6,7 +6,6 @@ import (
 	"sync"
 	"testing"
 
-	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/grafana/grafana/pkg/services/ldap"
 	"github.com/grafana/grafana/pkg/services/ssosettings/models"
 	"github.com/stretchr/testify/require"
@@ -309,7 +308,6 @@ func TestReload(t *testing.T) {
 	for _, tt := range testCases {
 		t.Run(tt.description, func(t *testing.T) {
 			ldapImpl := &LDAPImpl{
-				features:     featuremgmt.WithManager(featuremgmt.FlagSsoSettingsApi),
 				loadingMutex: &sync.Mutex{},
 			}
 
@@ -544,7 +542,6 @@ func TestValidate(t *testing.T) {
 	for _, tt := range testCases {
 		t.Run(tt.description, func(t *testing.T) {
 			ldapImpl := &LDAPImpl{
-				features:     featuremgmt.WithManager(featuremgmt.FlagSsoSettingsApi),
 				loadingMutex: &sync.Mutex{},
 			}
 

pkg/services/navtree/navtreeimpl/admin.go

@@ -183,7 +183,7 @@ func (s *ServiceImpl) getAdminNode(c *contextmodel.ReqContext) (*navtree.NavLink
 	configNodes = append(configNodes, usersNode)
 
 	if authConfigUIAvailable && hasAccess(ssoutils.EvalAuthenticationSettings(s.cfg)) ||
-		(hasAccess(ssoutils.OauthSettingsEvaluator(s.cfg)) && s.features.IsEnabled(ctx, featuremgmt.FlagSsoSettingsApi)) {
+		hasAccess(ssoutils.OauthSettingsEvaluator(s.cfg)) {
 		configNodes = append(configNodes, &navtree.NavLink{
 			Text:      "Authentication",
 			Id:        "authentication",

pkg/services/ssosettings/ssosettingsimpl/service.go

@@ -93,10 +93,8 @@ func ProvideService(cfg *setting.Cfg, sqlStore db.DB, ac ac.AccessControl,
 
 	usageStats.RegisterMetricsFunc(svc.getUsageStats)
 
-	if features.IsEnabledGlobally(featuremgmt.FlagSsoSettingsApi) {
-		ssoSettingsApi := api.ProvideApi(svc, routeRegister, ac)
-		ssoSettingsApi.RegisterAPIEndpoints()
-	}
+	ssoSettingsApi := api.ProvideApi(svc, routeRegister, ac)
+	ssoSettingsApi.RegisterAPIEndpoints()
 
 	return svc
 }

pkg/services/ssosettings/ssosettingstests/service_fake.go

@@ -0,0 +1,119 @@
+package ssosettingstests
+
+import (
+	context "context"
+
+	"github.com/grafana/grafana/pkg/apimachinery/identity"
+	"github.com/grafana/grafana/pkg/services/ssosettings"
+	models "github.com/grafana/grafana/pkg/services/ssosettings/models"
+)
+
+var _ ssosettings.Service = (*FakeService)(nil)
+
+type FakeService struct {
+	ExpectedSSOSetting          *models.SSOSettings
+	ExpectedSSOSettings         []*models.SSOSettings
+	ExpectedError               error
+	ExpectedReloadablesRegistry map[string]ssosettings.Reloadable
+
+	ActualSSOSettings models.SSOSettings
+	ActualPatchData   map[string]any
+	ActualProvider    string
+	ActualRequester   identity.Requester
+
+	ListFn                              func(ctx context.Context) ([]*models.SSOSettings, error)
+	ListWithRedactedSecretsFn           func(ctx context.Context) ([]*models.SSOSettings, error)
+	GetForProviderFn                    func(ctx context.Context, provider string) (*models.SSOSettings, error)
+	GetForProviderWithRedactedSecretsFn func(ctx context.Context, provider string) (*models.SSOSettings, error)
+	UpsertFn                            func(ctx context.Context, settings *models.SSOSettings, requester identity.Requester) error
+	DeleteFn                            func(ctx context.Context, provider string) error
+	PatchFn                             func(ctx context.Context, provider string, data map[string]any) error
+	RegisterReloadableFn                func(provider string, reloadable ssosettings.Reloadable)
+	ReloadFn                            func(ctx context.Context, provider string)
+}
+
+func NewFakeService() *FakeService {
+	return &FakeService{
+		ExpectedReloadablesRegistry: make(map[string]ssosettings.Reloadable),
+	}
+}
+
+func (f *FakeService) List(ctx context.Context) ([]*models.SSOSettings, error) {
+	if f.ListFn != nil {
+		return f.ListFn(ctx)
+	}
+	return f.ExpectedSSOSettings, f.ExpectedError
+}
+
+func (f *FakeService) ListWithRedactedSecrets(ctx context.Context) ([]*models.SSOSettings, error) {
+	if f.ListWithRedactedSecretsFn != nil {
+		return f.ListWithRedactedSecretsFn(ctx)
+	}
+	return f.ExpectedSSOSettings, f.ExpectedError
+}
+
+func (f *FakeService) GetForProvider(ctx context.Context, provider string) (*models.SSOSettings, error) {
+	if f.GetForProviderFn != nil {
+		return f.GetForProviderFn(ctx, provider)
+	}
+	f.ActualProvider = provider
+	return f.ExpectedSSOSetting, f.ExpectedError
+}
+
+func (f *FakeService) GetForProviderWithRedactedSecrets(ctx context.Context, provider string) (*models.SSOSettings, error) {
+	if f.GetForProviderWithRedactedSecretsFn != nil {
+		return f.GetForProviderWithRedactedSecretsFn(ctx, provider)
+	}
+	f.ActualProvider = provider
+	return f.ExpectedSSOSetting, f.ExpectedError
+}
+
+func (f *FakeService) Upsert(ctx context.Context, settings *models.SSOSettings, requester identity.Requester) error {
+	if f.UpsertFn != nil {
+		return f.UpsertFn(ctx, settings, requester)
+	}
+
+	f.ActualSSOSettings = *settings
+	f.ActualRequester = requester
+
+	return f.ExpectedError
+}
+
+func (f *FakeService) Delete(ctx context.Context, provider string) error {
+	if f.DeleteFn != nil {
+		return f.DeleteFn(ctx, provider)
+	}
+
+	f.ActualProvider = provider
+
+	return f.ExpectedError
+}
+
+func (f *FakeService) Patch(ctx context.Context, provider string, data map[string]any) error {
+	if f.PatchFn != nil {
+		return f.PatchFn(ctx, provider, data)
+	}
+
+	f.ActualProvider = provider
+	f.ActualPatchData = data
+
+	return f.ExpectedError
+}
+
+func (f *FakeService) RegisterReloadable(provider string, reloadable ssosettings.Reloadable) {
+	if f.RegisterReloadableFn != nil {
+		f.RegisterReloadableFn(provider, reloadable)
+		return
+	}
+
+	f.ExpectedReloadablesRegistry[provider] = reloadable
+}
+
+func (f *FakeService) Reload(ctx context.Context, provider string) {
+	if f.ReloadFn != nil {
+		f.ReloadFn(ctx, provider)
+		return
+	}
+
+	f.ActualProvider = provider
+}