Please be more specific as to what you're trying to do. Providing exact steps to reproduce would be best.

Here is the use case:
1/ Enable security in "Configure Global Security"
2/ Select LDAP as Security Realm
3/ Enter LDAP settings. Enter"CN" as displayname.
4/ Save the config.
5/ Log as a new LDAP registered user. On the top right you see your First Name + Full Name (depending the CN field content on LDAP user record). --> Until that it's ok.
6/ Unlog from Jenkins.
7/ Go back in "Configure Global Security"
8/ In LDAP settings, change displayname by "mail"
9/ Save the config
10 / Log as previous LDAP registered user. On the top right you should see user's mail, but it's not the case, instead you get First Name + Full Name as "CN" was again the displayname.

The workaround : Delete the user from Jenkins and relog as it again, this will recreate it and this time you will get user's mail displayed as expected on the top right.

N.B. I tried to stop and restart Jenkins server after changing displayname at step 8, it doesn't solve the problem

Regards

Right, this is only for the initial creation of a user record in Jenkins. Afterwards, it can be changed in Jenkins (/user/USERNAME/configure) only.

Reclassifying this as a feature request.

One possible problem here is that an out of date display name set by the realm (which should probably be replaced) is indistinguishable from a completely custom display name set in Jenkins.

Thanks for the reply.
Concerning the distinction between out of date display name and custom name, we should deal that as it:
On user configuration screen we have a ratio button choice
-Allow display name synchronization with LDAP -> This will make the custom name text box read only, leaving it in grey background color.
-Custom display name -> This will enable the custom name text box for edition. So we take account that custom display name instead of this from realm.

What's your opinion?

This will make no sense for authentication realms that do not provide a display name. And the user screen isn't extensible that way (remember, LDAP auth realm is a plugin that depends on available extension points; and core extension points need to make sense for multiple implementations).

One possibility that could be solved in the plugin would be to store the last know display name from LDAP in the user record, and always compare it to the one reported by LDAP; if it changes, check if the display name of the user is the same – if it is, update it, else don't. Then update the stored known LDAP display name.

Besides that, I think the more common use case is when a user's field in LDAP is changed rather than reconfiguration of Jenkins. Same problem, but cannot be solved by manually fixing things, as e.g. changing teams/departments (if part of the display name field) of some user likely happens without the Jenkins admin knowing.