The foreman rpm packages uses "getent passwd foreman" (or foreman-proxy) to determine if it should create the local users, so if you have IPA foreman-proxy or foreman users it won't create the local ones.  

Better that foreman's running as a local user with the right uid/gid's imho.