Cross-forest trust - not supported but partially working?

[fdalfa]

Hello,

I know that cross-forest trust is declared as not supported but.. our environment is similar to #7544 and #6843: we have

1. main.com forest
2. sub.main.com forest (it looks a main.com child but no, is a forest)
3. bidirectional trust between above forests

we have then some linux machines with sssd configured for direct ad integration on sub.main.com forest and GPO access control; the GPO declares

• users belonging to a [email protected] forest can log
• users belonging to a [email protected] forest can log

and everything works fine until we put a main.com user into [email protected]: the first user's login attempt fails, the subsequent ones are ok. If we wait some minutes (a cache expiring?), again: the first login fails, the subsequents are ok.

IMHO the above is a straightforward cross-forest group memberships case, I understood that sssd will not handle it but.. why does it works after the first failure? I expected to have no login at all, I dunno if some odd parameters (eg. a timeout) may solve my issue.

thanks and regards,
Fabrizio