# Many to Many group\_dn \<-\> org\_role mapping in LDAP config **URL:** \ **Category:** Configuration\ **Tags:** org, ldap\ **Created:** [April 28, 2017, 4:28pm UTC](https://community.grafana.com/t/many-to-many-group-dn-org-role-mapping-in-ldap-config/729 "2017-04-28T16:28:49Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![jfreedman](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/jfreedman/32/324_2.png) [@jfreedman](https://community.grafana.com/u/jfreedman)\ **Post date:** [April 28, 2017, 4:28pm UTC](https://community.grafana.com/t/many-to-many-group-dn-org-role-mapping-in-ldap-config/729/1 "2017-04-28T16:28:49Z")
In our organisation a given user will belong to one or more team groups in LDAP, I want to have multiple teams with Admin/Editor/Viewer roles but I am not sure how to accomplish this - I could not find any documentation other than [the example config](http://docs.grafana.org/installation/ldap/). Is this even possible? I would expect config like ``` [[servers.group_mappings]] group_dn = "CN=team-1,OU=bar,DC=foo,DC=com" org_role = "Admin" [[servers.group_mappings]] group_dn = "CN=team-2,OU=bar,DC=foo,DC=com" org_role = "Admin" ``` or ``` [[servers.group_mappings]] group_dn = [ "CN=team-1,OU=bar,DC=foo,DC=com", "CN=team-2,OU=bar,DC=foo,DC=com" ] org_role = "Admin" ``` ---
**Author:** ![daniellee](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/daniellee/32/41_2.png) [@daniellee](https://community.grafana.com/u/daniellee)\ **Post date:** [May 2, 2017, 2:19pm UTC](https://community.grafana.com/t/many-to-many-group-dn-org-role-mapping-in-ldap-config/729/2 "2017-05-02T14:19:50Z")
There is an `org_id` field that can be set per group mapping so your config should look similar to your first example: ```auto [[servers.group_mappings]] group_dn = "CN=team-1,OU=bar,DC=foo,DC=com" org_role = "Admin" org_id = 1 [[servers.group_mappings]] group_dn = "CN=team-2,OU=bar,DC=foo,DC=com" org_role = "Admin" org_id = 2 ``` There is some duplication here but that should work. ---
**Author:** ![jfreedman](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/jfreedman/32/324_2.png) [@jfreedman](https://community.grafana.com/u/jfreedman)\ **Post date:** [May 2, 2017, 2:46pm UTC](https://community.grafana.com/t/many-to-many-group-dn-org-role-mapping-in-ldap-config/729/3 "2017-05-02T14:46:11Z")
Thanks Daniel, that fixed the issue, it would be great to tweak the docs to make that obvious, I’ve submitted a pull request on github @ [https://github.com/grafana/grafana/pull/8275](https://github.com/grafana/grafana/pull/8275). ---
**Author:** ![jfreedman](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/jfreedman/32/324_2.png) [@jfreedman](https://community.grafana.com/u/jfreedman)\ **Post date:** [May 23, 2017, 1:52pm UTC](https://community.grafana.com/t/many-to-many-group-dn-org-role-mapping-in-ldap-config/729/4 "2017-05-23T13:52:52Z")
Is it possible that this configuration means that if a user in team-1 creates a dashboard then it’s visible to a different user in team-1 but not team-2? That’s the behavior we seem to be observing… Cheers Jon ---
**Author:** ![daniellee](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/daniellee/32/41_2.png) [@daniellee](https://community.grafana.com/u/daniellee)\ **Post date:** [May 24, 2017, 7:14am UTC](https://community.grafana.com/t/many-to-many-group-dn-org-role-mapping-in-ldap-config/729/5 "2017-05-24T07:14:59Z")
Yes, exactly. They are two different organizations and do not have access to each others dashboards. ---
**Author:** ![jfreedman](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/jfreedman/32/324_2.png) [@jfreedman](https://community.grafana.com/u/jfreedman)\ **Post date:** [May 24, 2017, 8:54am UTC](https://community.grafana.com/t/many-to-many-group-dn-org-role-mapping-in-ldap-config/729/6 "2017-05-24T08:54:51Z")
Ok, is there any way I can have both? 🙂 ---
**Author:** ![daniellee](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/daniellee/32/41_2.png) [@daniellee](https://community.grafana.com/u/daniellee)\ **Post date:** [May 24, 2017, 11:51am UTC](https://community.grafana.com/t/many-to-many-group-dn-org-role-mapping-in-ldap-config/729/7 "2017-05-24T11:51:30Z")
What’s the point in having two organizations if they should have access to each other’s dashboards? Is it just a way of grouping dashboards per team? I am working on a feature we call [Dashboard Folders](https://github.com/grafana/grafana/issues/1611) but it will be a while (probably after the summer) before it is ready. (So that’s not much help to you right now). You can give people access to both organizations and then they can switch between the orgs but you are asking if it is possible to see the other orgs’ dashboards without switching? ---
**Author:** ![jfreedman](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/jfreedman/32/324_2.png) [@jfreedman](https://community.grafana.com/u/jfreedman)\ **Post date:** [May 24, 2017, 2:10pm UTC](https://community.grafana.com/t/many-to-many-group-dn-org-role-mapping-in-ldap-config/729/8 "2017-05-24T14:10:40Z")
I don’t think I do want to organisations, what I want is to avoid creating new groups in active directory just to manage logins to grafana i.e. team-1, team-2 groups get admin roles, team-3 gets editor role, team-4 and team-5 get viewer role. ---
**Author:** ![tailoredbrands](https://avatars.discourse-cdn.com/v4/letter/t/977dab/32.png) [@tailoredbrands](https://community.grafana.com/u/tailoredbrands)\ **Post date:** [October 30, 2019, 1:35am UTC](https://community.grafana.com/t/many-to-many-group-dn-org-role-mapping-in-ldap-config/729/9 "2019-10-30T01:35:23Z")
> [@jfreedman](#): > > t admin roles, tea same request from me too i.e. team-1, team-2 groups get admin roles, team-3 gets editor role, team-4 and team-5 get viewer role. ---
**Author:** ![tailoredbrands](https://avatars.discourse-cdn.com/v4/letter/t/977dab/32.png) [@tailoredbrands](https://community.grafana.com/u/tailoredbrands)\ **Post date:** [October 30, 2019, 2:15am UTC](https://community.grafana.com/t/many-to-many-group-dn-org-role-mapping-in-ldap-config/729/10 "2019-10-30T02:15:44Z")
Good Solution. It works for me as well… If we dont want to have multiple org …dont mention the org then by default it will take Ord=1 and both groups will have access with same roles