ipa-adtrust-install: configure compatibility tree to serve trusted domain users
    
    Enables  support  for  trusted  domains  users  for old clients through Schema
    Compatibility plugin.  SSSD supports trusted domains natively starting with
    version 1.9 platform. For platforms that lack SSSD or run older SSSD version
    one needs  to  use  this  option.  When  enabled, slapi-nis  package  needs  to
    be  installed  and schema-compat-plugin will be configured to provide lookup of
    users and groups from trusted domains via SSSD on IPA server. These users and
    groups will be available under  cn=users,cn=compat,$SUFFIX  and
    cn=groups,cn=compat,$SUFFIX trees.  SSSD will normalize names of users and
    groups to lower case.
    
    In  addition  to  providing  these users and groups through the compat tree,
    this option enables authentication over LDAP for trusted domain users with DN
    under compat tree, i.e. using bind DN uid=administrator@ad.domain,cn=users,cn=compat,$SUFFIX.
    
    This authentication  is related to  PAM  stack  using  'system-auth' PAM
    service. If you have disabled HBAC rule 'allow_all', then make sure there is
    special service called 'system-auth' created and HBAC rule to allow access to
    anyone to this rule on IPA masters is added. Please note that system-auth PAM
    service is  not used directly by any other application, therefore it is safe to
    create one specifically to support trusted domain users via compatibility path.
    
    https://fedorahosted.org/freeipa/ticket/3567