The precendence on the modrdn plugin was set in the wrong location.

https://fedorahosted.org/freeipa/ticket/1370

daemons/ipa-slapi-plugins/ipa-modrdn/modrdn-conf.ldif

@@ -13,3 +13,4 @@ nsslapd-pluginversion: 1.0
 nsslapd-pluginvendor: Red Hat, Inc.
 nsslapd-plugindescription: IPA MODRDN plugin
 nsslapd-plugin-depends-on-type: database
+nsslapd-pluginPrecedence: 60

install/share/modrdn-krbprinc.ldif

@@ -9,4 +9,3 @@ ipaModRDNtargetAttr: krbPrincipalName
 ipaModRDNsuffix: @$REALM
 ipaModRDNfilter: (&(objectclass=posixaccount)(objectclass=krbPrincipalAux))
 ipaModRDNscope: $SUFFIX
-nsslapd-pluginPrecedence: 60

install/updates/10-config.update

@@ -4,7 +4,11 @@
 dn: cn=config
 only:nsslapd-ssl-check-hostname: on
 
+# Remove incorrect placement
+dn: cn=Kerberos Principal Name,cn=IPA MODRDN,cn=plugins,cn=config
+remove: nsslapd-pluginPrecedence: 60
+
 # Set the precedence of the ipa-modrdn plugin so it runs after other
 # plugins (the default is 50).
-dn: cn=Kerberos Principal Name,cn=IPA MODRDN,cn=plugins,cn=config
+dn: cn=IPA MODRDN,cn=plugins,cn=config
 only: nsslapd-pluginPrecedence: 60