Currently, foreman doesn't support the "default" hashing algo used by RHEL6.

If you use the following line in your kickstart:

authconfig --useshadow --passalgo=sha512

The resulting encrypted path will not be using sha512, which means you'll get authentication errors when the host is provisioned.

My workaround right now, is to NOT let foreman encrypt the passwords.
I have foreman set the initial password to "password" (in plaintext)

rootpw password

And then on the first puppet run, I have a module that changes the password to what it should be, using SHA512.