Created attachment 1136927
trust console log

Description of problem: Tree-root domains in a trusted AD forest aren't marked
as reachable via the forest root


Version-Release number of selected component (if applicable):

[root@host2 ~]# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.2 (Maipo)

ipa-server-dns-4.2.0-15.el7_2.10.x86_64
ipa-server-trust-ad-4.2.0-15.el7_2.10.x86_64
ipa-server-4.2.0-15.el7_2.10.x86_64
sssd-1.13.0-40.el7_2.2.x86_64

How reproducible:Always

Steps to Reproduce:
1. Setup forest  i.e pne.qe
2. Setup child domain i.e chd.pne.qe
3. Setup a tree domain i.e test.qa
4. Installed IPA. ipa-adtrust-install
5. Setup two-way trust
6. Ensure child domain and tree-root domain is listed.
7. run id <username@tree-rootdomain> on IPA server

Actual results:
"id <username>" when executed on IPA server/client doesn't display users
present in the tree domain.

[root@host2 ~]# id user5@test.qa
id: user5@test.qa: no such user
[root@host2 ~]# id user6@test.qa
id: user6@test.qa: no such user

Expected results:
id <username> output should display users present in the tree domain as well.

Additional info:
Attaching the console logs and sssd logs.