---
title: Configuring LDAP authentication in Grafana
slug: how-tos/T3ZK-setting-up
createdAt: 2025-09-02T15:14:55.696Z
---

## Requirements

Before starting, make sure you have:

- Server Admin permissions in Grafana (v11.3.0 or higher)
- [Retrieved LDAP connection details](docId\:jhGOacGdOWPR5dfB-cLIs)
- Connection to LDAP server

## Configure authentication

To configure LDAP authentication in Grafana, go to **Administration > Authentication > LDAP**.

:::hint{type="info"}
Don't see LDAP? The `ssoSettingsLDAP` feature toggle must be enabled in the `grafana.ini` config file (requires command line access on the Grafana server or ask Factry support).
:::

1. Fill in the LDAP connection [details](docId\:jhGOacGdOWPR5dfB-cLIs):
   - Fill in the `Basic Settings`.
   - **Don't** add `(` and `)` around the search filter.
   - Click **Edit** and fill in the `Advanced Settings` > `Extra Security Measures`.
   - More information in the Grafana guide: [Configure LDAP authentication](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/ldap/).
2. Click **Save & test** to verify the configuration.

If the connection is successful, the configuration should save without errors.

:::hint{type="info"}
Troubles configuring the authentication? Have a look at [Troubleshooting LDAP authentication](docId\:wk5CkWzCILSVYy4xxz-lh).
:::

![](https://api.archbee.com/api/optimize/5fbu7Arve_PpG6EAsx3L9-lFUvdldTs4bX0eCAgUJb3-20250904-134343.png)

![](https://api.archbee.com/api/optimize/5fbu7Arve_PpG6EAsx3L9-5sUIdz0dqpsp0XafoK2qo-20250904-134938.png)

### Default role

If you log out and try to log in with a LDAP user (with a username that does not exist in Grafana), the user receives the default role in Grafana for the default organization (usually `Viewer`, which is set in `grafana.ini`).
To manage permissions of the user, there are 2 options:

1. Manually assign a role to a user: see Grafana's [Assign roles to a user](https://grafana.com/docs/grafana/latest/alerting/set-up/configure-roles/#assign-roles)
2. [Configure group mapping](docId\:T3ZKM3zqFU2qWS1tDPyjJ) via LDAP

If the LDAP user matches a username of an existing user in Grafana, that user will be logged in (when `Skip organization role sync` in `Group mapping`is enabled) as opposed to creating a new user.

## Configure group mapping

Perform the following steps to create a `user group mapping`:

:::hint{type="info"}
When group mapping is enabled, a user in Grafana can not be manually configured into a user group, since on each login the user will be linked to the user groups matching in LDAP. To manually assign users to groups in Grafana, skip this section.
:::

1. Go to **Administration > Authentication > LDAP**.
2. Make sure to disable the `Skip organization role sync`.
3. In the LDAP server, find the DN of the group(s) with identities (users) you want to give permissions in Grafana.
4. In Grafana, find the `Org ID` of the organization for which the user needs to receive permissions. Go to **Administration > General > Organizations** for an overview of the `Org ID's`.
5. In Grafana, add a `user group mapping` using the DN of the group.

:::hint{type="warning"}
The order of the group mapping in Grafana **matters**. Grafana uses only the first matching group mapping, so put higher-privilege mappings first. More information can be found in Grafana documentation [here](https://grafana.com/docs/grafana/latest/setup-grafana/configure-access/configure-authentication/ldap/#group-mappings).
:::

The `Group search filter`, `Group search base DNS` and the `Group name attribute` are optional and to be used if the Group DN is set as an attribute of the LDAP group rather than the DN itself.

![](https://api.archbee.com/api/optimize/5fbu7Arve_PpG6EAsx3L9-juNwcqwcCCMeG4GZtzFYE-20250904-141229.png)

On saving a `group mapping`, all the identities (users) in the LDAP group(s) matching the given DN will be granted the permissions of the mapped Grafana role in the Organization with the indicated `Org ID`.

:::hint{type="success"}
We **recommend** group mapping in Grafana for each role you plan to have: Grafana Admin, Admin, Editor and Viewer.
:::

## Test authentication and group mapping

When successfully logging in with an LDAP user in Grafana, the user will be automatically created in Grafana (if it does not exist yet).

To test the authentication and group mapping:

1. Log out of Grafana.
2. Log in with your LDAP username or e-mail (depends on the `search filter`) and verify:

- If login succeeds without errors.
- If the correct user groups are applied to the user in Grafana.

:::hint{type="info"}
Troubles configuring the authentication? Have a look at [Troubleshooting LDAP authentication](docId\:wk5CkWzCILSVYy4xxz-lh).
:::