A deployment wants to implement "User Based Authentication" (UBA) on their firewall. This is a Checkpoint Firewall-one. This firewall has the possibility to dynamically set up firewall rules based on the user. The firewall queries AD for all information required to do this. Part of these queries are the computer objects in AD. The Linux hosts are only in IdM. The deployment tried to create computer objects for the Linux hosts manually in AD, but this does not work, because AD must be able to communicate with the computer object, otherwise they are qualifeid as "disabled/offline" and it won't work.

For the above to work the idea is:

1. Create a compat subtree that re-exports IPA hosts with proper attributes that AD expects (as extensibleObject, as we don't have proper AD schema anyway)
2. Create an additional LDAP Account Unit (in Checkpoint Firewall) that presents IdM deployment domains and uses one of IPA users or system account to bind to IPA LDAP.

More details https://sc1.checkpoint.com/documents/R76/CP_R76_IdentityAwareness_AdminGuide/62402.htm#o62423

This ticket is about item 1. above:

Compat tree is configured via cn=config, so it would require administrative (directory manager) privileges, which means it would be some extension of ipa-compat-manage. It would make sense, probably, to do it in a generic way by allowing to manage all subtrees.