My company uses the below for admin accounts. Foreman doesn't like the parens in the Surname portion:
firstname: firstname
surname: Lastname (Admin)

Foreman returns an 'invalid surname' error when using ldap auth (against AD) with 'auto create users'