Issue

I am unable to rename an account after enabling subid support, and generating a subid for an account

Steps to Reproduce

1. Enable subid support, use included script to generate subid's for all users, or do an individual account with "ipa subid-generate --owner="
2. Try to rename the account with "ipa user-mod --rename=

Actual behavior

An error happens and the attempt is aborted. When looking at the dirsrv error log:

[06/Nov/2025:09:09:01.741275830 -0600] - ERR - get_value_from_string - type does not match: dsEntryDN != dsEntryDN;vucsn-68f12ab70000000f0000
[06/Nov/2025:09:09:01.932930359 -0600] - ERR - oc_check_required - Entry "ipauniqueid=05c48cfb-5503-4162-9e14-648d88767356,cn=subids,cn=accounts,dc=us,dc=ep,dc=corp,dc=local" missing attribute "ipaOwner" required by object class "ipaSubordinateId"
[06/Nov/2025:09:09:01.933838475 -0600] - ERR - referint-plugin - _update_all_per_mod - Entry ipauniqueid=05c48cfb-5503-4162-9e14-648d88767356,cn=subids,cn=accounts,dc=us,dc=ep,dc=corp,dc=local failed (65)
[06/Nov/2025:09:09:01.934989371 -0600] - ERR - oc_check_required - Entry "ipauniqueid=05c48cfb-5503-4162-9e14-648d88767356,cn=subids,cn=accounts,dc=us,dc=ep,dc=corp,dc=local" missing attribute "ipaOwner" required by object class "ipaSubordinateId"
[06/Nov/2025:09:09:01.936187948 -0600] - WARN - memberof-plugin - Entry ipauniqueid=05c48cfb-5503-4162-9e14-648d88767356,cn=subids,cn=accounts,dc=us,dc=ep,dc=corp,dc=local - schema violation caught - repair operation succeeded
[06/Nov/2025:09:09:01.937103924 -0600] - ERR - oc_check_required - Entry "ipauniqueid=05c48cfb-5503-4162-9e14-648d88767356,cn=subids,cn=accounts,dc=us,dc=ep,dc=corp,dc=local" missing attribute "ipaOwner" required by object class "ipaSubordinateId"
[06/Nov/2025:09:09:01.937911140 -0600] - ERR - slapi_entry_schema_check_ext - Entry "ipauniqueid=05c48cfb-5503-4162-9e14-648d88767356,cn=subids,cn=accounts,dc=us,dc=ep,dc=corp,dc=local" single-valued attribute "ipaOwner" has multiple values
[06/Nov/2025:09:09:01.940516533 -0600] - WARN - flush_hash - Upon BETXN callback failure, entry cache is flushed during 0.000252889
[06/Nov/2025:09:09:01.941317487 -0600] - WARN - flush_hash - Upon BETXN callback failure, entry cache is flushed during 0.000233924

Expected behavior

Rename to work

Version/Release/Distribution

$ Rocky 10, ipa-server 4.12.2.

Additional info:

If you remove the subid from the account using ldapdelete, rename will work again for that account.