@johannes_meixne    The only place you would use "{0}" would be in the ldap-provider used for user authentication.  The {0} gets replaced with the username entered in the login UI.  The LdapUserGroupProvider however is used by the nifi authorizer to assemble a list of users and group strings (along with the association/membership between those user and groups) which can be used to assign authorizations against.  The LdapUserGroupProvider executes on NiFi startup and then on a configured schedule to refresh the synced users and groups.  Since it takes no input you can not use "{0}" in the search filter. ... View more