IBM WAS - Accepting Kerberos tokens from two different AD KDCs

I am assuming Example scenario topology
---------------------------
                                                                       
WAS machine -- WAS.domain1.com
                                         
websphere security using AD -- AD1.domain1.com

same AD using one of KDC server keytab created -- AD1.domain1.com

KDC server2 Ketab created -- KDC.domain1.com  
                       
url hiting  -- ‘webserver.domain1.com’ is a DNS entry that routes to the Web Server

My sugestion
-------------

1) First they need to trust these domains AD1.domain1.com and KDC.domain4.com

The following scenarios are supported for trust relation between domains.                                  
Support information for SPNEGO Web authentication with a browser client  
The following scenarios are supported:                                  
Cross-forest trusts                                                      
Domain trust within the same forest                                      
Kerberos realm trust                                                    
                                                                         
The following scenarios are not supported:                              
Forest external trusts                                                  
Domain external trusts        

2) They need to configure Websphere security to use federated repository so that customer use option referral --> follow

Select the type of referral.  A referral is an entity that is used to redirect a client request to another LDAP server. A referral contains the names and locations of other objects. It is sent by the server to indicate that the information that the client requested can be found at another location, possibly at another server or several servers. The default value is ignore.

follow
    Referrals are followed automatically.

3) I believe you need to merge these two keytab created from KDC servers keytab  -- AD1.domain1.com and  server2 Ketab  -- KDC.domain1.com

Not sure about this.  I understand KDC referrals, but in this case, I don't need a referral.  I have users authenticated in two different ADs.  (By the way, these ADs are NOT used for authorization, so don't need to be federated for access by WAS.  They are never directly accessed, only produce tickets that are consumed by WAS.)  Upon authentication, the separate ADs will produce tickets for server access themselves, since both must have an SPN for the service registered in them.

What version of websphere ?

Additional check the following comment from the following link

http://www.ibm.com/developerworks/websphere/library/techarticles/0809_lansche/0809_lansche.html

  *  You do not need to configure the WebSphere registry to be Microsoft Active Directory via the Lightweight Directory Access Protocol (LDAP). In general, the user ID obtained from the service ticket is known as the Kerberos UserPrincipalName. Specifically Microsoft calls it the ClientPrincipalName. This user ID must map to a meaningful name in the WebSphere security registry. The simplest mapping is where the WebSphere registry is the LDAP provided by Active Directory. We have considerable experience deploying the SPNEGO TAI with trivial and non-trivial mappings, including where the WebSphere registry was a:
          o WebSphere Federated repository composed of one or more underlying LDAP registries
          o Single Active Directory domain LDAP
          o Set of Active Directory LDAP servers configured as an Active Directory Forest
          o IBM Tivoli Directory Server LDAP
          o Domino LDAP
          o z/OS® RACF registry
          o Custom User Registry (various types)

These mapping solutions require the creation of customer-specific custom code, typically in the form of a LoginModule to morph the Java Subject built by the TAI that contains the Windows identity, into a new Java Subject containing the mapped-to user ID valid in the WebSphere registry. The mechanics of these LoginModules are beyond the scope of this article and require an expert to create.

WAS 6.1
The registry is not an issue in this question.  We know how to handle that.
The issue is being able to configure WAS to accept tickets from two different ticket servers for the same service.  
Does the app need to be addressable via two different URLs, that match to the two kerberos realms?
Do we just register SPNs in both KDCs and merge the resulting keytabs?
How does this affect the .conf file?
Has anyone actually done this and seen it work?

Do we just register SPNs in both KDCs and merge the resulting keytabs?

---> You need to merge the both keytab files

How does this affect the .conf file?

---> In WAS v6.1 I am not sure  if you can merge conf file if you have  single jvm. because conf file contains default domain contains one kdc name.. not sure how we can define multiple domains to use... on single conf file..

I am researching on this...

Has anyone actually done this and seen it work?

--> I haven't tried this...