Let's say I have two active directories: AD-1 and AD-2 and I want to obtain the following behaviour:
When someone tries to do a LDAP search on the AD-2 for authentication to check AD-2 database first and if the user is not found to delegate it to AD-1.
This has to be transparent for the client trying to verify the credentials.
Reasoning: I have some web application that are using LDAP autentication and checking the AD-2 server. AD-1 would be the main corporate one, one that I cannot control, but the AD-2 is under my control.
I need to be able to add users to AD-2, users that are not in AD-1. Still any user frm AD-1 cand be considered as valid for AD-2.
AD-2 contains users from outside the company.
Note: I have minimal experience configuring AD.