diff --git a/modules/statistics/config-templates/module_statistics.php b/modules/statistics/config-templates/module_statistics.php
index cda18ab6e3e53be9250f5e795b39749b3b6e938c..00d01ec718b19155c5103354f0b52df68900e869 100644
--- a/modules/statistics/config-templates/module_statistics.php
+++ b/modules/statistics/config-templates/module_statistics.php
@@ -5,20 +5,24 @@
 
 $config = array (
 
+	/* Authentication & authorization for statistics. */
+
+	/* Whether the statistics require authentication before use. */
 	'protected' => FALSE,
+
+	/* The authentication source that should be used. */
 	'auth' => 'admin',
-	'useridattr' => 'eduPersonPrincipalName',
-	
-	'default' => 'sso',
-	
-	'allowedUsers' => array(
-		'admin'
-	),
-	
+
+	/* Alternative 1: List of allowed users. */
+	//'useridattr' => 'eduPersonPrincipalName',
+	//'allowedUsers' => array('andreas@uninett.no', 'ola.normann@sp.example.org'),
+
+	/* Alternative 2: External ACL list. */
+	//'acl' => 'adminlist',
+
+
+
 	'default' => 'sso_hoursweek',
-	
-	'useridattr' => 'eduPersonPrincipalName',
-	'allowedUsers' => array('andreas@uninett.no', 'ola.normann@sp.example.org'),
 
 	'statdir' => '/tmp/stats/',
 	'inputfile' => '/var/log/simplesamlphp.stat',
diff --git a/modules/statistics/www/showstats.php b/modules/statistics/www/showstats.php
index d9356349119dfd086b340227dbea5257e59ae309..db434ee8df45c31589c9ae422c0dec52f5e57444 100644
--- a/modules/statistics/www/showstats.php
+++ b/modules/statistics/www/showstats.php
@@ -13,6 +13,11 @@ $authsource = $statconfig->getString('auth', NULL);
 $allowedusers = $statconfig->getValue('allowedUsers', NULL);
 $useridattr = $statconfig->getString('useridattr', 'eduPersonPrincipalName');
 
+$acl = $statconfig->getValue('acl', NULL);
+if ($acl !== NULL && !is_string($acl) && !is_array($acl)) {
+	throw new SimpleSAML_Error_Exception('Invalid value for \'acl\'-option. Should be an array or a string.');
+}
+
 if ($protected) {
 
 	if (SimpleSAML_Utilities::isAdmin()) {
@@ -26,18 +31,40 @@ if ($protected) {
 		
 		// Retrieving attributes
 		$attributes = $session->getAttributes();
-		
-		// Check if userid exists
-		if (!isset($attributes[$useridattr])) 
-			throw new Exception('User ID is missing');
-		
-		// Check if userid is allowed access..
-		if (!in_array($attributes[$useridattr][0], $allowedusers)) {
-			SimpleSAML_Logger::debug('Statistics auth - User denied access by user ID [' . $attributes[$useridattr][0] . ']');
-			throw new Exception('Access denied for this user.');
+
+		$allow = FALSE;
+		if (!empty($allowedusers)) {
+			// Check if userid exists
+			if (!isset($attributes[$useridattr][0]))
+				throw new Exception('User ID is missing');
+
+			// Check if userid is allowed access..
+			if (!in_array($attributes[$useridattr][0], $allowedusers)) {
+				SimpleSAML_Logger::debug('Statistics auth - User denied access by user ID [' . $attributes[$useridattr][0] . ']');
+			} else {
+				SimpleSAML_Logger::debug('Statistics auth - User granted access by user ID [' . $attributes[$useridattr][0] . ']');
+				$allow = TRUE;
+			}
+		} else {
+			SimpleSAML_Logger::debug('Statistics auth - no allowedUsers list.');
 		}
-		SimpleSAML_Logger::debug('Statistics auth - User granted access by user ID [' . $attributes[$useridattr][0] . ']');		
-		
+
+		if (!$allow && !is_null($acl)) {
+			$acl = new sspmod_core_ACL($acl);
+			if (!$acl->allows($attributes)) {
+				SimpleSAML_Logger::debug('Statistics auth - denied access by ACL.');
+			} else {
+				SimpleSAML_Logger::debug('Statistics auth - allowed access by ACL.');
+				$allow = TRUE;
+			}
+		} else {
+			SimpleSAML_Logger::debug('Statistics auth - no ACL configured.');
+		}
+
+		if (!$allow) {
+			throw new SimpleSAML_Error_Exception('Access denied to the current user.');
+		}
+
 	} elseif(isset($authsource)) {
 		// If user is not logged in init login with authrouce if authsousrce is defined.
 		SimpleSAML_Auth_Default::initLogin($authsource, SimpleSAML_Utilities::selfURL());