diff --git a/src/main/java/com/googlesource/gerrit/plugins/lfs/GetLfsGlobalConfig.java b/src/main/java/com/googlesource/gerrit/plugins/lfs/GetLfsGlobalConfig.java
index 40e00b0..ebbc81c 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/lfs/GetLfsGlobalConfig.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/lfs/GetLfsGlobalConfig.java
@@ -14,19 +14,11 @@
 
 package com.googlesource.gerrit.plugins.lfs;
 
-import static com.google.gerrit.server.permissions.GlobalPermission.ADMINISTRATE_SERVER;
-
 import com.google.common.collect.Maps;
-import com.google.gerrit.extensions.restapi.ResourceNotFoundException;
 import com.google.gerrit.extensions.restapi.RestApiException;
 import com.google.gerrit.extensions.restapi.RestReadView;
-import com.google.gerrit.server.CurrentUser;
-import com.google.gerrit.server.IdentifiedUser;
-import com.google.gerrit.server.config.AllProjectsName;
-import com.google.gerrit.server.permissions.PermissionBackend;
 import com.google.gerrit.server.project.ProjectResource;
 import com.google.inject.Inject;
-import com.google.inject.Provider;
 import com.google.inject.Singleton;
 import java.util.HashMap;
 import java.util.List;
@@ -34,29 +26,17 @@
 @Singleton
 class GetLfsGlobalConfig implements RestReadView<ProjectResource> {
   private final LfsConfigurationFactory lfsConfigFactory;
-  private final AllProjectsName allProjectsName;
-  private final Provider<CurrentUser> self;
-  private final PermissionBackend permissionBackend;
+  private final LfsAdminView adminView;
 
   @Inject
-  GetLfsGlobalConfig(
-      LfsConfigurationFactory lfsConfigFactory,
-      AllProjectsName allProjectsName,
-      Provider<CurrentUser> self,
-      PermissionBackend permissionBackend) {
+  GetLfsGlobalConfig(LfsConfigurationFactory lfsConfigFactory, LfsAdminView adminView) {
     this.lfsConfigFactory = lfsConfigFactory;
-    this.allProjectsName = allProjectsName;
-    this.self = self;
-    this.permissionBackend = permissionBackend;
+    this.adminView = adminView;
   }
 
   @Override
   public LfsGlobalConfigInfo apply(ProjectResource resource) throws RestApiException {
-    IdentifiedUser user = self.get().asIdentifiedUser();
-    if (!(resource.getNameKey().equals(allProjectsName)
-        && permissionBackend.user(user).testOrFalse(ADMINISTRATE_SERVER))) {
-      throw new ResourceNotFoundException();
-    }
+    adminView.validate(resource);
 
     LfsGlobalConfigInfo info = new LfsGlobalConfigInfo();
     LfsGlobalConfig globalConfig = lfsConfigFactory.getGlobalConfig();
diff --git a/src/main/java/com/googlesource/gerrit/plugins/lfs/LfsAdminView.java b/src/main/java/com/googlesource/gerrit/plugins/lfs/LfsAdminView.java
new file mode 100644
index 0000000..d9d2ad7
--- /dev/null
+++ b/src/main/java/com/googlesource/gerrit/plugins/lfs/LfsAdminView.java
@@ -0,0 +1,57 @@
+// Copyright (C) 2019 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.googlesource.gerrit.plugins.lfs;
+
+import static com.google.gerrit.server.permissions.GlobalPermission.ADMINISTRATE_SERVER;
+
+import com.google.gerrit.extensions.restapi.ResourceNotFoundException;
+import com.google.gerrit.server.CurrentUser;
+import com.google.gerrit.server.config.AllProjectsName;
+import com.google.gerrit.server.permissions.PermissionBackend;
+import com.google.gerrit.server.project.ProjectResource;
+import com.google.inject.Inject;
+import com.google.inject.Provider;
+import com.google.inject.Singleton;
+
+@Singleton
+public class LfsAdminView {
+  private final AllProjectsName allProjectsName;
+  private final PermissionBackend permissionBackend;
+  private final Provider<CurrentUser> self;
+
+  @Inject
+  LfsAdminView(
+      AllProjectsName allProjectsName,
+      PermissionBackend permissionBackend,
+      Provider<CurrentUser> self) {
+    this.allProjectsName = allProjectsName;
+    this.permissionBackend = permissionBackend;
+    this.self = self;
+  }
+
+  /**
+   * Validate REST call.
+   *
+   * @param resource the resource
+   * @throws ResourceNotFoundException if the calling user is not admin, or the resource is not
+   *     {@code All-Projects}.
+   */
+  public void validate(ProjectResource resource) throws ResourceNotFoundException {
+    if (!(resource.getNameKey().equals(allProjectsName)
+        && permissionBackend.user(self.get()).testOrFalse(ADMINISTRATE_SERVER))) {
+      throw new ResourceNotFoundException();
+    }
+  }
+}
diff --git a/src/main/java/com/googlesource/gerrit/plugins/lfs/PutLfsGlobalConfig.java b/src/main/java/com/googlesource/gerrit/plugins/lfs/PutLfsGlobalConfig.java
index 20865c3..ea4e44e 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/lfs/PutLfsGlobalConfig.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/lfs/PutLfsGlobalConfig.java
@@ -14,7 +14,6 @@
 
 package com.googlesource.gerrit.plugins.lfs;
 
-import static com.google.gerrit.server.permissions.GlobalPermission.ADMINISTRATE_SERVER;
 import static com.googlesource.gerrit.plugins.lfs.LfsProjectConfigSection.KEY_BACKEND;
 import static com.googlesource.gerrit.plugins.lfs.LfsProjectConfigSection.KEY_ENABLED;
 import static com.googlesource.gerrit.plugins.lfs.LfsProjectConfigSection.KEY_MAX_OBJECT_SIZE;
@@ -27,11 +26,7 @@
 import com.google.gerrit.extensions.restapi.RestApiException;
 import com.google.gerrit.extensions.restapi.RestModifyView;
 import com.google.gerrit.reviewdb.client.Project;
-import com.google.gerrit.server.CurrentUser;
-import com.google.gerrit.server.IdentifiedUser;
-import com.google.gerrit.server.config.AllProjectsName;
 import com.google.gerrit.server.git.meta.MetaDataUpdate;
-import com.google.gerrit.server.permissions.PermissionBackend;
 import com.google.gerrit.server.project.ProjectResource;
 import com.google.inject.Inject;
 import com.google.inject.Provider;
@@ -48,9 +43,7 @@
 class PutLfsGlobalConfig implements RestModifyView<ProjectResource, LfsGlobalConfigInput> {
 
   private final String pluginName;
-  private final AllProjectsName allProjectsName;
-  private final PermissionBackend permissionBackend;
-  private final Provider<CurrentUser> self;
+  private final LfsAdminView adminView;
   private final Provider<MetaDataUpdate.User> metaDataUpdateFactory;
   private final LfsConfigurationFactory lfsConfigFactory;
   private final GetLfsGlobalConfig get;
@@ -58,16 +51,12 @@
   @Inject
   PutLfsGlobalConfig(
       @PluginName String pluginName,
-      AllProjectsName allProjectsName,
-      PermissionBackend permissionBackend,
-      Provider<CurrentUser> self,
+      LfsAdminView adminView,
       Provider<MetaDataUpdate.User> metaDataUpdateFactory,
       LfsConfigurationFactory lfsConfigFactory,
       GetLfsGlobalConfig get) {
     this.pluginName = pluginName;
-    this.allProjectsName = allProjectsName;
-    this.permissionBackend = permissionBackend;
-    this.self = self;
+    this.adminView = adminView;
     this.metaDataUpdateFactory = metaDataUpdateFactory;
     this.lfsConfigFactory = lfsConfigFactory;
     this.get = get;
@@ -76,14 +65,9 @@
   @Override
   public LfsGlobalConfigInfo apply(ProjectResource resource, LfsGlobalConfigInput input)
       throws RestApiException {
-    IdentifiedUser user = self.get().asIdentifiedUser();
+    adminView.validate(resource);
     Project.NameKey projectName = resource.getNameKey();
 
-    if (!(projectName.equals(allProjectsName)
-        && permissionBackend.user(user).testOrFalse(ADMINISTRATE_SERVER))) {
-      throw new ResourceNotFoundException();
-    }
-
     if (input == null) {
       input = new LfsGlobalConfigInput();
     }
diff --git a/src/test/java/com/googlesource/gerrit/plugins/lfs/LfsIT.java b/src/test/java/com/googlesource/gerrit/plugins/lfs/LfsIT.java
new file mode 100644
index 0000000..265f47d
--- /dev/null
+++ b/src/test/java/com/googlesource/gerrit/plugins/lfs/LfsIT.java
@@ -0,0 +1,50 @@
+// Copyright (C) 2019 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.googlesource.gerrit.plugins.lfs;
+
+import com.google.gerrit.acceptance.GerritConfig;
+import com.google.gerrit.acceptance.LightweightPluginDaemonTest;
+import com.google.gerrit.acceptance.TestPlugin;
+import com.google.gerrit.reviewdb.client.Project;
+import org.junit.Test;
+
+@TestPlugin(
+    name = "lfs",
+    sysModule = "com.googlesource.gerrit.plugins.lfs.Module",
+    httpModule = "com.googlesource.gerrit.plugins.lfs.HttpModule",
+    sshModule = "com.googlesource.gerrit.plugins.lfs.SshModule")
+public class LfsIT extends LightweightPluginDaemonTest {
+  @Test
+  @GerritConfig(name = "lfs.plugin", value = "lfs")
+  public void globalConfigCanBeReadByAdmin() throws Exception {
+    adminRestSession.get(globalConfig(allProjects)).assertOK();
+  }
+
+  @Test
+  @GerritConfig(name = "lfs.plugin", value = "lfs")
+  public void globalConfigCannotBeReadByNonAdmin() throws Exception {
+    userRestSession.get(globalConfig(allProjects)).assertNotFound();
+  }
+
+  @Test
+  @GerritConfig(name = "lfs.plugin", value = "lfs")
+  public void globalConfigCannotBeReadOnOtherProject() throws Exception {
+    adminRestSession.get(globalConfig(project)).assertNotFound();
+  }
+
+  private static String globalConfig(Project.NameKey name) {
+    return String.format("/projects/%s/lfs:config-global", name.get());
+  }
+}