migrate process cannot handle multivalued pkey attribute
    
    When group/user is migrated, the attribute used for RDN may be
    multivalued. Make sure that we pick the value used in the RDN
    which should be the unique one and not just the first one.
    
    https://fedorahosted.org/freeipa/ticket/1892