Even users that do not have the primary domain as their account address are synched, but they can not log-in
The reason is that on-demand uses an outdated login screen which prescribes the domain name (fixes it to the primary domain), instead of leaving the user enter the domain as it is now the standard for google apps.
So the current situation is 'broken' one way or another. Either such users should not be synchronized or the updated login dialog should be used.