Yes, it is possible to do so. It will require you to turn on the compatibility tree and point to do that dn. More than likely you'll need to run `ipa-adtrust-install --enable-compat` on all IPA servers that are trust controllers/agents. Once you do so, you'll get a cn=compat,... you can use.

Users: cn=users,cn=compat,dc=ipa,dc=example,dc=com
Groups: cn=groups,cn=compat,dc=ipa,dc=example,dc=com

What will happen is all IPA users and groups typically show up immediately. But the AD users/groups will not until there is a query for them (eg ldapsearch or bind attempt), which should be sufficient. In my previous cases of using the compat tree, it was for Solaris, FreeBSD, and RHEL 5, and I didn't run into too many issues.

Virus-free. www.avast.com