OAuth: Allow assigning Server Admin (#54780)

* extract errors to errors file

* implement oauth server admin assignment

* add server admin tests

* deduplicate autoAssignOrgRole

* deduplicate strict setting

* deduplicate strict setting

* add support for generic oauth

* add role attribute strict support for generic oauth

* add support for github/gitlab

* assignGrafanaAdmin option is here to stay

* unify similar errors

* add config option

* add okta server admin mapping

* remove never used Company attribute

* unify generic oauth role extract with other methods

* case insensitive role match as in azure

* add ini settings

* add server admin to devenv

* remove duplicate fields

* add documentation to oauth

* fix titlecase test

* implement doc feedback

docs/sources/setup-grafana/configure-security/configure-authentication/gitlab.md

@@ -58,6 +58,9 @@ auth_url = https://gitlab.com/oauth/authorize
 token_url = https://gitlab.com/oauth/token
 api_url = https://gitlab.com/api/v4
 allowed_groups =
+role_attribute_path =
+role_attribute_strict = false
+allow_assign_grafana_admin = false
 ```
 
 You may have to set the `root_url` option of `[server]` for the callback URL to be
@@ -102,7 +105,7 @@ characters. Make sure you always use the group or subgroup name as it appears
 in the URL of the group or subgroup.
 
 Here's a complete example with `allow_sign_up` enabled, with access limited to
-the `example` and `foo/bar` groups. The example also promotes all GitLab Admins to Grafana Admins:
+the `example` and `foo/bar` groups. The example also promotes all GitLab Admins to Grafana organization admins:
 
 ```ini
 [auth.gitlab]
@@ -116,6 +119,8 @@ token_url = https://gitlab.com/oauth/token
 api_url = https://gitlab.com/api/v4
 allowed_groups = example, foo/bar
 role_attribute_path = is_admin && 'Admin' || 'Viewer'
+role_attribute_strict = true
+allow_assign_grafana_admin = false
 ```
 
 ### Map roles
@@ -126,7 +131,7 @@ For the path lookup, Grafana uses JSON obtained from querying GitLab's API [`/ap
 
 An example Query could look like the following:
 
-```bash
+```ini
 role_attribute_path = is_admin && 'Admin' || 'Viewer'
 ```
 
@@ -139,12 +144,33 @@ Groups can also be used to map roles. Group name (lowercased and unique) is used
 For instance, if you have a group with display name 'Example-Group' you can use the following snippet to
 ensure those members inherit the role 'Editor'.
 
-```bash
+```ini
 role_attribute_path = contains(groups[*], 'example-group') && 'Editor' || 'Viewer'
 ```
 
 Note: If a match is found in other fields, groups will be ignored.
 
+#### Map server administrator privileges
+
+> Available in Grafana v9.2 and later versions.
+
+If the application role received by Grafana is `GrafanaAdmin`, Grafana grants the user server administrator privileges.  
+This is useful if you want to grant server administrator privileges to a subset of users.  
+Grafana also assigns the user the `Admin` role of the default organization.
+
+The setting `allow_assign_grafana_admin` under `[auth.gitlab]` must be set to `true` for this to work.  
+If the setting is set to `false`, the user is assigned the role of `Admin` of the default organization, but not server administrator privileges.
+
+```ini
+allow_assign_grafana_admin = true
+```
+
+Example:
+
+```ini
+role_attribute_path = is_admin && 'GrafanaAdmin' || 'Viewer'
+```
+
 ### Team Sync (Enterprise only)
 
 > Only available in Grafana Enterprise v6.4+