I have 3 full trust domains (2 child and one root). I need to use LDAP to allow authntication for domain users. The trick is that I need the application to use an AD server for the child domain BUT proxy the LDAP query and authentication for the root domain. I see that it maty be possible with AD LDS and some trusts and synching, but it looks pretty hairy and overly complicated.

The short of it is:

1. 3 domains (Parent, ChildA, ChildB)
2. My 3rd party app will need to use ChildA domain servers to authenticate either: a. a user in the parent domain or b. a user in the ChildB domain
3. I already have full trusts between all domains, and regular NTLM authentication works fine (unless you are trying to authenticate with LDAP)