<div dir="ltr">I am using IPA 4.1 in CenOS7. And I can login to system after "id syncopex5", maybe it's cache problem. </div><div class="gmail_extra"> <div class="gmail_quote">2015-11-16 11:24 GMT+08:00 Rob Crittenden <<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>>: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">zhiyong xue wrote: > We integrated the Apache Syncope server with FreeIPA server. So user can > self register ID from Apache Syncope then synchronize to FreeIPA. The > problems are: > *1) User created from Apache Syncope can't login to linux. The user > created from FreeIPA web gui works well.* For login issues see <a href="https://fedorahosted.org/sssd/wiki/Troubleshooting" rel="noreferrer" target="_blank">https://fedorahosted.org/sssd/wiki/Troubleshooting</a> This is unlikely to fix things but it will help with later debugging. This likely revolves around how you are creating these accounts. We'll need information on what you're doing. The more details the better. > *2) The user also can't be deleted from web UI and CLI. It said > "syncopex5: user not found".* Again, you probably aren't creating the users correctly. I can only assume that you are creating the users directly via an LDAP add. This is working around the IPA framework which does additional work. Knowing what version of IPA this is would help too. You'll probably also want to read this: <a href="http://www.freeipa.org/page/V4/User_Life-Cycle_Management" rel="noreferrer" target="_blank">http://www.freeipa.org/page/V4/User_Life-Cycle_Management</a> . This is in IPA 4.2. rob rob </blockquote></div> </div>