I have Identity Management (IPA) running on RHEL 7.6, with some test users added. After I join a machine to the domain (with ipa-client-install) with no errors, I cannot figure out how to login as one of these test users I added. I'm using the default allow_all HBAC. Running "kinit" works; it prompts me for that user's password, gets the kerberos ticket, and then the ticket shows up with "klist". I can run "getent passwd" and "getent group" and have no errors but the users do not exist if I check with "id" or try to "su".
Any ideas on what I could be missing?