Remote-Name does not return cn when using LLDAP

[SheevaPlug]

Describe the Bug

I use Tinyauth.app in a Docker Swarm with Caddy forward_auth and LLDAP. In LLDAP, there is a user with the following data in LDIF:

dn: uid=readonly,ou=people,dc=example,dc=com
cn: Readonly User
createtimestamp: 20260701130846Z
entryuuid: bf8ae209-5fcf-3211-b85a-38509015c81f
first_name: Readonly
givenname: Readonly
last_name: User
mail: lldap_readonly_user@example.com
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: mailAccount
objectclass: person
sn: User
uid: readonly

After logging in as this user, by web application receives the following HTTP headers:

Remote-Email: readonly@example.com
Remote-Groups: lldap_strict_readonly
Remote-Name: Readonly
Remote-User: readonly

How to Reproduce

No response

Expected Behavior

I'd expect to get the "cn" attribute with the full name, but instead I'm only getting either "first_name" or "givenname".

Additional Context

No response

Logs

No response

Operating System

Kubuntu Linux 26.04

Browser

Firefox 151.0.3

Tinyauth Version

v5.0.7

Docker Version (if applicable)

29.6.1

Human Written Confirmation

• I confirm this issue was written by me and not generated by an LLM or AI assistant.

[dosubot]

Hi @SheevaPlug! I'm Dosu and I'm helping the Tinyauth team.

This looks like a confirmed limitation in how Tinyauth handles LDAP display names. The Remote-Name header is not populated from any LDAP attribute like cn, givenName, or displayName. Instead, Tinyauth simply capitalizes the LDAP username [1]:

userContext.LDAP.Name = utils.Capitalize(userContext.LDAP.Username)

So for your user uid=readonly, the username "readonly" gets capitalized to "Readonly" — which is what you're seeing.

The LDAP user lookup in GetUserInfo() only requests ["dn", "mail"] attributes from the LDAP server [2], so cn is never fetched. There's currently no configuration option to control which LDAP attribute maps to the display name [3].

This contrasts with OAuth/OIDC providers in Tinyauth, which do support configurable display name attributes. Adding support for fetching cn (or a configurable attribute) from LDAP and using it for Remote-Name would be a feature enhancement.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[SheevaPlug]

Hi @dosu,

thank you for your quick reply. After having some short looks into the code, i had already feared that. And then, it is not an easy task to develop software that incorporates so many and mostly incompatible data sources. This said, I appreciate your great work even more, thank you a lot!

But then, i still seem to miss something. The DN of an LDAP entry is something like "uid=readonly,ou=people,dc=example,dc=com" as seen in my LDIF above. Where is this getting converted into "readonly"? The only usage of ldap.ParseDN is in 1 to get the group names, so... what do I miss here?