A method for determining whether a user from an organization is a member of a group pre-defined within the organization, the organization maintaining a computer network comprising at least a forest A and a forest B, forest A having a directory A and a querying entity A capable of querying directory A, forest B having a directory B and a querying entity B capable of querying directory B, the method comprising:
- querying entity A receiving a request from the user, querying entity A deciding whether to grant the request based at least in part on the user being a member of the group;
- querying entity A querying directory A of forest A to return information on the group and in response being directed to forest B;
- querying entity A contacting querying entity B of forest B and requesting querying entity B to query directory B whether the user is a member of the group;
- querying entity A receiving in response from querying entity B whether the user is in fact a member of the group;
- and
- querying entity A granting the request from the user based at least in part on whether the user is a member of the group.