---
title: Introduction to LDAP
slug: how-tos/N_D7-intro
createdAt: 2026-05-08T09:03:38.000Z
---

LDAP can be used as an identity provider for both Grafana and Factry Historian. It is a protocol that provides a standardized way to organize identity data stored in a hierarchical directory structure.

An LDAP server:

- keeps information about users, groups, and permissions in one central place
- allows for multiple applications to connect to the LDAP server, check your identity and grant permissions
- is compatible with most identity services like Active Directory and others

## Naming Structure

LDAP identity data is organized in a hierarchical tree structure called the DIT. Each entry in the DIT (such as a user, group, or organizational unit) is uniquely identified by its DN.
A DN works like a file system path: it is built from the entry’s own name (its Relative Distinguished Name, or RDN) plus the chain of parent entries up to the root.

For example:

:::BlockQuote
cn=John Doe,ou=Users,dc=example,dc=com
:::

This DN uniquely identifies the single entry “John Doe” in the Users organizational unit OU of the example.com domain.
Groups in LDAP are also entries, but instead of containing users directly inside their DN, they typically list the DNs of their members.

💡 **Example naming structure:**

:::BlockQuote
cn=Accounting Managers,ou=Groups,dc=example,dc=com
:::

::Image[]{src="https://api.archbee.com/api/optimize/5fbu7Arve_PpG6EAsx3L9-b633i-fFwefcMtDs9kN33-20250903-132753.png" size="80" width="1432" height="395" position="center" darkWidth="1432" darkHeight="395" showCaption="false"}

### Special characters

When a DN holds [a special character](https://www.ibm.com/docs/en/sva/10.0.8?topic=tasks-valid-characters-ldap-user-group-names), it needs to be escaped for correct interpretation.
Escape a special character by inserting a `\` just before it.

**For example:**
The special character `;` is written as `\;`.
Meaning a CN `Factry;s services` in the DN, becomes:

:::BlockQuote
cn=Factry\\;s services,ou=MyCompany,dc=MyDomain,dc=com
:::

More information on escaping special characters in LDAP can be found [here](https://jumpcloud.com/it-index/escaping-special-characters-in-ldap-filters).

## Search LDAP identities

Find below some key terms to understand when searching for LDAP identities:

- **Bind User DN**: The distinguished name of a user which is used to search (bind to the interface of) the LDAP server. Set read-only access for this user **(recommended)**.
- **Base DN**: The starting point (base) for all LDAP searches. All users which are to be authenticated against the LDAP server must be found within the DIT starting from the Base DN.
- **Search filter**: Defines the criteria for searching the DIT from the Base DN to match identities (users).
  For example, this search filter matches users where the CN = the username in the application (%s is replaced by username in Factry Historian/Grafana).

:::BlockQuote
(cn=%s)
:::

- **Attributes**: Each identity (user) holds a set of properties that define a unique identity.
  - **Email**: The email of the identity.
  - **FirstName**: The first name of the identity.
  - **LastName**: The last name of the identity.
  - **MemberOf**: The group DN's the identity is part of.
  - **Locale**: The language/region of the identity.