where do tdo trust object exist
However, SSSD can use TDO object which always exists in AD for the trusting domain (cross-forest trust is done by forest root domains' trust). This means the ticket SSSD would need to request belongs to a different realm (AD forest root realm) rather than to FreeIPA realm.