It can be done, but you might give up when you see the maintenance involved...

So you have an entity with a random name, "inside" which there is a entity-alias with the sAMAccountName attribute of a given user.

Background

Entity creation is not done by the ldap auth backend. An entity will be created if Vault can't find an existing entity with a matching entity alias.

So basically it does this:

1. Try to find an existing entity with that alias in it
2. Create a new entity if none is found

The problem is that Vault can't use the entity alias attribute value as a name, because you can have multiple entity alias for any given entity. Other auth backends (like Github) could have a different entity alias attribute. Vault is not in position to decide which one it should use so a random name is chosen.

It can be done

To have predictable names for your entities, you would have to create the entity with the name of your choice and the alias in advance, so that it is present when the user first logs in and Vault goes looking for it.

I would suggest that you learn to live with random names for three reasons:

1. Management
2. Race conditions
3. License cost

Management

You will have to poll your Active Directory for changes and create/delete entity alias as users come and go. Keep in mind that Vault will not validate the entity alias is valid, that's your job. Not a complex piece of code, but it won't write and maintain itself and you probably have better things to do.

Race conditions

Even with a synchronisation mechanism in place, there is still a change a user logs in Vault between two passes of your script. That user will get a random entity name. You script could account for that and fix it on the next run, but it will make your synchronization code more complex.

Licenses

Vault Enterprise is licensed per entity. Creating an entity alias for everyone in your Active Directory could get expensive. Your script could account for that too, creating entity alias for members of a given group only, but... you get the idea.

You might were this is going: if you want to control the entity name

After the ixe013 answer, I decided to make a script to look for "entity_xxx" default names and change them to the LDAP appropriate username.

It was a success!

The essential part of the script is shown following.

# GET THE VAULT ENTITY LIST
entity_list=$(curl --header "X-Vault-Token: $TOKEN" --request LIST "https://VAULT-SERVER/v1/identity/entity/name" | jq --raw-output .data.keys[])

# FOR EACH ENTITY
for e in $entity_list
do
    # GET THE ENTITY INFORMATION
    entity_info=$(curl --header "X-Vault-Token: $TOKEN" --request GET "https://VAULT-SERVER/v1/identity/entity/name/$e")

    # GET THE LDAP USERNAME
    user=$(echo $entity_info | jq --raw-output '.data.aliases[] | select(.mount_type=="ldap") | .name')

    # VERIFY IF LDAP USERNAME EXISTS AND IT IS DIFFERENT FROM ENTITY NAME
    if [[ $user != "" && $user != $e ]]
    then
        # GET THE ENTITY ID
        id=$(echo $entity_info | jq --raw-output .data.id)

        # FIX THE ENTITY NAME
        curl --header "X-Vault-Token: $TOKEN" --request POST "https://VAULT-SERVER/v1/identity/entity/id/$id" <<EOF
        {
            "name": "$user"
        }
EOF
    fi
done