This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/1025

IPA cannot handle Multi-master Replication conflicts correctly. Attribute conflicts are solved via 389-ds, but conflicts over DN not. When 2 LDAP records with the same DN are detected during synchronization, 389-ds renames one of them to, e.g. `dn: nsuniqueid=0a950601-435311e0-86a2f5bd-3cd26022+uid=utest,cn=users,cn=accounts,dc=idm,dc=lab,dc=bos,dc=redhat,dc=com` which will confuse the IPA server.

In this case, `user-find` will display records like this one but is not able to manipulate it (rename, delete). This may lead to unpleasant issues that can be solved only by manual LDAP update. IPA should provide some way to at least remove (preferably rename) records like these.

'''Reproduction scenario:'''

Prepare 3 replicating IPA servers in a star topology. Shut down the central server (SRV1) and add a record with the same DN on the remaining boxes (SRV2, SRV3), e.g.:

{{{
SRV2: $ ipa user-add --first=User1 --last=Test1 utest
SRV3: $ ipa user-add --first=User2 --last=Test2 utest
}}}

Start the SRV1 again, directory synchronization will create the following 2 records:

{{{
SRV1: $ ipa user-find --all --raw
  dn: uid=utest,cn=users,cn=accounts,dc=idm,dc=lab,dc=bos,dc=redhat,dc=com
  uid: utest
  givenname: User2
  sn: Test2
...

  dn: nsuniqueid=0a950601-435311e0-86a2f5bd-3cd26022+uid=utest,cn=users,cn=accounts,dc=idm,dc=lab,dc=bos,dc=redhat,dc=com
  uid: utest
  givenname: User1
  sn: Test1
  cn: User1 Test1
...
}}}

Then:

{{{
$ ipa user-del utest
----------------------
Deleted user "utest"
----------------------
$ ipa user-add --first=User --last=Test utest
ipa: ERROR: Constraint violation: Another entry with the same attribute value already exists (attribute: "krbPrincipalName")
}}}

because of dangling record `dn: nsuniqueid=...+uid=utest,cn=users,cn=accounts,dc=idm,dc=lab,dc=bos,dc=redhat,dc=com`