This is actually an IPA issue, as outlined here:
https://fedorahosted.org/389/ticket/47361

unfortunately the errors are pretty non-intuitive.

On the foreman side it manifests as an error in the production.log:
Search Message: Protocol Error

On the IPA server side you will see:
..., failed to decode LDAP controls

The patch attached to the ticket above does fix it, but we might not see it in RHEL for awhile, so I thought it might be wise to track it somewhere in case users hit the problem. Maybe if there is a Known Issues section in the Release Notes it could be listed there.