Well, at this point (pre 7.5), there isn't an agent, the WSA is joined to the domain, just like a Windows box, it authenticates via that trust relationship. From that point it is all based on how NT/Active Directory domains work. As long as there is a trust between the domains, you can can auth users from as many domains as you like.
There is an agent in the works. The ADAgent will be released with 7.5. The code is already available, it was released with the ASA ver 8.4, and it will be used to pass authentication info to the WSA. At this point, current versions still require trust relationships between all of the domains touched.
Taken from the setup guide: http://www.cisco.com/en/US/docs/security/ibf/setup_guide/ibf10_install.html#wp1054011
Before you configure even a single domain controller machine using the
adacfg dc create
command, ensure that the AD Agent machine is first joined to a domain (for example, domain
J
) that has a trust relationship with each and every domain (for example, domain
D[i]
) that it will monitor for user authentications (through the domain controller machines that you will be configuring on the AD Agent machine).
Depending on your Active Directory domain structure, the following scenarios are possible:
1. 
Single Forest, Single Domain—There is only one domain, D[i] for all domain controller machines, which is one and the same as domain J. The AD Agent machine must first be joined to this single domain, and since no other domains are involved, there is no need to configure any trust relationship with any other domain.
2. Single Forest, Multiple Domains—All the domains in a single forest already have an inherent two-way trust relationship with each other. Thus, the AD Agent must first be joined to one of the domains, J, in this forest, with this domain J not necessarily being identical to any of the domains D[i] corresponding to the domain controller machines. Because of the inherent trust relationship between domain J and each of the domains D[i], there is no need to explicitly configure any trust relationships.
3. Multiple Forests, Multiple Domains—It is possible that domain J might belong to a forest that is different than the forest to which one or more of the domains D[i] corresponding to the domain controller machines belong. In this case, you must explicitly ensure that each of the domains D[i] has an effective trust relationship with domain J, in at least one of the following two ways:
a. A two-way external trust relationship can be established between the two domains, D[i] and J
b. A two-way forest trust relationship can be established between the the forest corresponding to domain D[i] and the forest corresponding to domain J
