This message was deleted.

No, Connector Appliance cannot bridge the gap because FAS (and the FAS bits on the VDA) does a upn lookup itself. Your options for multi-domain FAS are either two-way FAS or using shadow accounts ('true federation') - or as you say merging into 1 domain.

Yeah that is what I discovered. We ended up building out PKI in forest1.local and left the original PKI alone in the other forest in case they need it in the future. Thanks for the reply.