<div dir="ltr"><div>I query a new user syncopex8, it's same created from Apache Syncope server. The output of command "ldapsearch -x -h localhost -b dc=exampe,dc=com uid=syncopex8": # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope subtree # filter: uid=syncopex8 # requesting: ALL # # syncopex8, users, compat, <a href="http://example.com">example.com</a> dn: uid=syncopex8,cn=users,cn=compat,dc=example,dc=com cn: x8syncope objectClass: posixAccount objectClass: top gidNumber: 657600044 gecos: x8syncope uidNumber: 657600044 loginShell: /bin/sh homeDirectory: /home/syncopex8 uid: syncopex8 # syncopex8, users, accounts, <a href="http://example.com">example.com</a> dn: uid=syncopex8,cn=users,cn=accounts,dc=example,dc=com objectClass: top objectClass: person objectClass: organizationalperson objectClass: inetorgperson objectClass: inetuser objectClass: posixAccount objectClass: krbprincipalaux objectClass: krbticketpolicyaux objectClass: ipaobject objectClass: ipasshuser objectClass: ipaSshGroupOfPubKeys objectClass: mepOriginEntry cn: x8syncope displayName: x8syncope uid: syncopex8 gecos: x8syncope uidNumber: 657600044 gidNumber: 657600044 loginShell: /bin/sh homeDirectory: /home/syncopex8 sn: syncope givenName: x8 initials: xs # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2 The output of command "ldapsearch -x -h localhost -b dc=exampe,dc=com cn=syncopex8": # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope subtree # filter: cn=syncopex8 # requesting: ALL # # syncopex8, groups, compat, <a href="http://example.com">example.com</a> dn: cn=syncopex8,cn=groups,cn=compat,dc=example,dc=com gidNumber: 657600044 objectClass: posixGroup objectClass: top cn: syncopex8 # syncopex8, groups, accounts, <a href="http://example.com">example.com</a> dn: cn=syncopex8,cn=groups,cn=accounts,dc=example,dc=com objectClass: posixgroup objectClass: ipaobject objectClass: mepManagedEntry objectClass: top cn: syncopex8 gidNumber: 657600044 description: User private group for syncopex8 mepManagedBy: uid=syncopex8,cn=users,cn=accounts,dc=example,dc=com ipaUniqueID: 1c07557c-8cce-11e5-8f72-fa163e630e3d # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2 </div>The output of command "ipa user-showsyncopex8 --raw --all" <div> dn: uid=syncopex8,cn=users,cn=accounts,dc=example,dc=com uid: syncopex8 givenname: x8 sn: syncope cn: x8syncope initials: xs homedirectory: /home/syncopex8 gecos: x8syncope loginshell: /bin/sh mail: <a href="mailto:x8@example.com">x8@example.com</a> uidnumber: 657600044 gidnumber: 657600044 nsaccountlock: FALSE has_password: TRUE has_keytab: TRUE displayName: x8syncope ipaUniqueID: 1bffe8b4-8cce-11e5-8f72-fa163e630e3d krbExtraData: AALHiEpWcm9vdC9hZG1pbkBCTVguSUJNLkNPTQA= krbLastPwdChange: 20151117015415Z krbPasswordExpiration: 20151117015415Z krbPrincipalName: <a href="mailto:syncopex8@EXAMPLE.COM">syncopex8@EXAMPLE.COM</a> memberOf: cn=ipausers,cn=groups,cn=accounts,dc=example,dc=com mepManagedEntry: member=syncopex8,cn=groups,cn=accounts,dc=example,dc=com mepManagedEntry: cn=syncopex8,cn=groups,cn=accounts,dc=example,dc=com objectClass: top objectClass: person objectClass: organizationalperson objectClass: inetorgperson objectClass: inetuser objectClass: posixAccount objectClass: krbprincipalaux objectClass: krbticketpolicyaux objectClass: ipaobject objectClass: ipasshuser objectClass: ipaSshGroupOfPubKeys objectClass: mepOriginEntry </div><div>The output of command "ipa group-show syncopex8 --raw --all": dn: cn=syncopex8,cn=groups,cn=accounts,dc=example,dc=com cn: syncopex8 description: User private group for syncopex8 gidnumber: 657600044 ipaUniqueID: 1c07557c-8cce-11e5-8f72-fa163e630e3d mepManagedBy: uid=syncopex8,cn=users,cn=accounts,dc=example,dc=com objectClass: posixgroup objectClass: ipaobject objectClass: mepManagedEntry objectClass: top </div></div><div class="gmail_extra"> <div class="gmail_quote">2015-11-16 17:49 GMT+08:00 Tomas Babej <<a href="mailto:tbabej@redhat.com" target="_blank">tbabej@redhat.com</a>>: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Can you provide a result of a LDAP search run on that entry? As Rob points out, you're probably creating the user in a manner that bypasses the framework. Tomas On 11/16/2015 06:43 AM, zhiyong xue wrote: > I am using IPA 4.1 in CenOS7. And I can login to system after "id > syncopex5", maybe it's cache problem. > > 2015-11-16 11:24 GMT+08:00 Rob Crittenden <<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a> > <mailto:<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a>>>: <div class="HOEnZb"><div class="h5">> > zhiyong xue wrote: > > We integrated the Apache Syncope server with FreeIPA server. So user can > > self register ID from Apache Syncope then synchronize to FreeIPA. The > > problems are: > > *1) User created from Apache Syncope can't login to linux. The user > > created from FreeIPA web gui works well.* > > For login issues see <a href="https://fedorahosted.org/sssd/wiki/Troubleshooting" rel="noreferrer" target="_blank">https://fedorahosted.org/sssd/wiki/Troubleshooting</a> > This is unlikely to fix things but it will help with later debugging. > > This likely revolves around how you are creating these accounts. We'll > need information on what you're doing. The more details the better. > > > *2) The user also can't be deleted from web UI and CLI. It said > > "syncopex5: user not found".* > > Again, you probably aren't creating the users correctly. > > I can only assume that you are creating the users directly via an LDAP > add. This is working around the IPA framework which does additional > work. > > Knowing what version of IPA this is would help too. > > You'll probably also want to read this: > <a href="http://www.freeipa.org/page/V4/User_Life-Cycle_Management" rel="noreferrer" target="_blank">http://www.freeipa.org/page/V4/User_Life-Cycle_Management</a> . This is in > IPA 4.2. > > rob > rob > > > > </div></div>-- Manage your subscription for the Freeipa-users mailing list: <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project </blockquote></div> </div>