title: Can I match a user to a group accross different domains?
body: <p>I'm trying to write an LDAP query which will discover if a user is a member of a group which matches a wildcard query and I'm trying to use the LDAP_MATCHING_RULE_IN_CHAIN OID to do this.  I'm basically following example 2 on this page:</p>
  
  <p><a href="http://support.microsoft.com/kb/914828">http://support.microsoft.com/kb/914828</a></p>
  
  <p>I've found that this method works well within a domain i.e. if user1 is in group1 and group1 is in group2 then I can write a query matching "*2" and the LDAP query will find the nested relationship and match the user against the group.</p>
  
  <p>However, now I've been asked to support relationships between domains in the same forest.  So now I've got:</p>
  
  <ul>
  <li>user1 is a member of group1 in domain 1</li>
  <li>group1 in domain 1 is a member of group2 in domain 2</li>
  </ul>
  
  <p>And I want to be able to match user1 against group2.... I can't work out how to make LDAP_MATCHING_RULE_IN_CHAIN do this:</p>
  
  <p>I've tried setting the base of the query to the following:</p>
  
  <ol>
  <li>Domain 1, but this just returns groups in domain 1</li>
  <li>The parent domain of domain 1 and domain 2, but this returns no results.</li>
  <li>The GC, found by querying "rootDSE" property but this just returns groups inside the domain 1 (which is the GC server)</li>
  </ol>
  
  <p>Anyone know how I can make this work?</p>