Once we have implemented support for multiple DNS domains per our realm and discovering trusted domains behind AD domain we trust, we need to update logic in KDC driver to consider transitive trusts.

Before that could be implemented we need:

• Handle DNS suffixes for our domain and export them to trusted domains
• Fetch and maintain trusted realms out of AD trust
• be able to filter out both trusted domains and SIDs for them, incoming/outgoing

Tickets #2848, #2593, #3407 would need to be done before this ticket is going to be worked on.