ensure that the initial sync using GSSAPI works agains old masters
    
    IPA 3.x masters neither have 'cn=replication managers' sysaccount groups set,
    nor do they support adding nsds5ReplicaBinddnGroup attribute to the replica
    config objects.
    
    In order for common replication mechanism to work against
    them, the replica must be ready to supply the required information to the old
    master.
    
    https://fedorahosted.org/freeipa/ticket/6406
    
    Reviewed-By: Martin Basti <mbasti@redhat.com>