With external trust it is now possible to establish trust to a subdomain of already trusted forest. This means that for trust to example.com and external trust to child.example.com there are now two trusted paths to reach child.example.com: through forest root example.com and directly via external trust path child.example.com.

This configuration may cause issues when debugging trust-related problems. We need to use shortest path between trusted domains. This means child.example.com should be removed from the list of subdomains of example.com and instantiated as an external trust. This, however, will lead to both child.example.com and example.com be marked with the same list of UPN suffixes because child.example.com UPN list is derived from its own forest root (example.com). Such combination may break UPN support in SSSD.

A solution needs to be developed for covering both trust path and UPN suffix overlap.