Since it is a new user I wonder if maybe the RID is larger than 200000?
For automatic id-mapping a range of 200000 IDs is used by default and if
the RIDs become higher a new range should be added.

I think we have a winner.  RID > 200,000.  How do we properly increase this limit?  We tried increasing the id range in the freeipa ui from 200000 to 300000 for all of the domains but its not having an effect.  Same symptoms.