Yes, it is possible to do so. It will require you to turn on the compatibility tree and
point to do that dn. More than likely you'll need to run `ipa-adtrust-install
--enable-compat` on all IPA servers that are trust controllers/agents. Once you do so,
you'll get a cn=compat,... you can use.
What will happen is all IPA users and groups typically show up immediately. But the AD
users/groups will not until there is a query for them (eg ldapsearch or bind attempt),
which should be sufficient. In my previous cases of using the compat tree, it was for
Solaris, FreeBSD, and RHEL 5, and I didn't run into too many issues.
This email has been checked for viruses by Avast antivirus software.