<div dir="ltr"><div>The problem still exist after update from 4.1 to 4.2.3. </div>Rob, how to check the missed manage entry? </div><div class="gmail_extra"> <div class="gmail_quote">2015-11-20 0:11 GMT+08:00 Rob Crittenden <<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>>: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">zhiyong xue wrote: > Rob, where can I get more error information beside the log? > [16/Nov/2015:02:52:59 +0000] managed-entries-plugin - mep_del_post_op: > failed to delete managed entry > (member=syncopex5,cn=groups,cn=accounts,dc=example,dc=com) - error (32) I can still only assume what you're doing: manually adding the entries directly by LDAP. To do this you need to follow IPA conventions, or use the new user lifecycle framework added in 4.2. I'm guessing it can't delete the managed entry because either it doesn't exist or it is missing an objectclass/attribute marking it as managed. rob > > 2015-11-16 13:43 GMT+08:00 zhiyong xue <<a href="mailto:xuezhiy@gmail.com">xuezhiy@gmail.com</a> > <mailto:<a href="mailto:xuezhiy@gmail.com">xuezhiy@gmail.com</a>>>: > > I am using IPA 4.1 in CenOS7. And I can login to system after "id > syncopex5", maybe it's cache problem. > > 2015-11-16 11:24 GMT+08:00 Rob Crittenden <<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a> > <mailto:<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a>>>: <div class="HOEnZb"><div class="h5">> > zhiyong xue wrote: > > We integrated the Apache Syncope server with FreeIPA server. So user can > > self register ID from Apache Syncope then synchronize to FreeIPA. The > > problems are: > > *1) User created from Apache Syncope can't login to linux. The > user > > created from FreeIPA web gui works well.* > > For login issues see > <a href="https://fedorahosted.org/sssd/wiki/Troubleshooting" rel="noreferrer" target="_blank">https://fedorahosted.org/sssd/wiki/Troubleshooting</a> > This is unlikely to fix things but it will help with later > debugging. > > This likely revolves around how you are creating these accounts. > We'll > need information on what you're doing. The more details the better. > > > *2) The user also can't be deleted from web UI and CLI. It said > > "syncopex5: user not found".* > > Again, you probably aren't creating the users correctly. > > I can only assume that you are creating the users directly via > an LDAP > add. This is working around the IPA framework which does > additional work. > > Knowing what version of IPA this is would help too. > > You'll probably also want to read this: > <a href="http://www.freeipa.org/page/V4/User_Life-Cycle_Management" rel="noreferrer" target="_blank">http://www.freeipa.org/page/V4/User_Life-Cycle_Management</a> . This > is in > IPA 4.2. > > rob > rob > > > </div></div></blockquote></div> </div>