LDAP-AD synchronization with multiple domains

[ivan_plestina]

I've trying to setup ldap sync in a multiple domain and the scenario is:
domain.com (contains required groups and most users)
child.domain.com (several users are members of the groups in parent domain)
Only specific groups and users in them are synced.
Authentication is only passthru.

I'm getting the ldap sync error for several users in child domain. I'm not sure how to proceed now. I guess next step would be to add ldap-ad2 in chain for the child domain? But what about groups - do I need to create same groups in child domain and sync child domain users via them or Alfresco understands user's membership in parent domain groups?

Thanks

[brian_robinson]

It seems to me that you need to add ldap-ad2 into your authentication chain.  Regarding groups, I would assume that ldap-ad and ldap-ad2 would be treated as completely independent, thus ldap-ad2 would need to have the proper groups in there as well.

-Brian