Easiest path is a custom LDAP mapper — extend AbstractLDAPStorageMapper and override onImportUserFromLDAP to issue a second bind+search against the secondary tree using the user's DN/uid. Register it as a provider factory, then add it to your user-federation config; Keycloak calls it right after the main user import. There's no way to chain two searches in the built-in mappers; a custom one is the supported hook.