Using LDAP Provisioning.

1 - Enrolled and approved a user. Checked LDAP and confirmed provisioning took place.

2 - Edited Person record in CM for same. Added a new Role, with different COU.

3 - Received notification that provisioning failed. Attempted to manually provision user, and got response 'Provisioning failed: Type or value exists (500)'.

The LDAP attribute eduPersonAffiliation comes from the Role affiliation, so it looks like it fails when there are more than one.

This is important to us because our users will belong to multiple COUs with different capacities.