diff --git a/config.template.yml b/config.template.yml
index d5df6e74a..ce43491a6 100644
--- a/config.template.yml
+++ b/config.template.yml
@@ -66,7 +66,7 @@ authentication_backend:
     # The users filter used to find the user DN
     # {0} is a matcher replaced by username.
     # 'cn={0}' by default.
-    users_filter: cn={0}
+    users_filter: (cn={0})
 
     # An additional dn to define the scope of groups
     additional_groups_dn: ou=groups