As @BrentSouza writes on #9850:

Is your feature request related to a problem? Please describe.

When generating dynamic secrets like db/aws credentials, the DisplayName of the auth method is included in the generated user name/user name equivalent. When using a token granted via AppRole login, the DisplayName is unset, so the user just reads as:

vault-approle-***

Whereas if I login with okta for example it would be:

vault-okta-brentsouza-***

For logging purposes in target systems, it would be nice to have some concrete relation back to the AppRole context. I think the role name makes the most sense to use since it's most likely to be meaningful for the intended purpose.

Describe the solution you'd like

Set the role name as the DisplayName when a user/service logs in via AppRole.

@joernheissler continues:

I'm trying to create SSH host certificates with vault, and the hosts authenticate with their approle. In the Key ID, {{token_display_name}} is substituted with approle. Perhaps it changed from "empty string" in the past?

From what I can see in the current source code, the value is set in the LoginCreateToken function:

https://github.com/hashicorp/vault/blob/09c92b89cc94acf47afc6d1419cab266472ddf39/vault/request_handling.go#L2010-L2016

The ldap auth method sets DisplayName to the username:

https://github.com/hashicorp/vault/blob/09c92b89cc94acf47afc6d1419cab266472ddf39/builtin/credential/ldap/path_login.go#L90-L104

The approle method doesn't the set field, so it probably is the empty string, resulting in approle.

https://github.com/hashicorp/vault/blob/09c92b89cc94acf47afc6d1419cab266472ddf39/builtin/credential/approle/path_login.go#L368-L377

Might be enough to set DisplayName: role.name?

This makes sense, but likely should be made opt-in as this might change expectations of clients. Perhaps a display_name field could be introduced to the role, taking either the form role-name or static:<name>, with the latter setting an explicit display name.