I'm not aware how do I go with this. Will I need to think of having different OU's configured for each site and sync the OU's, control the write access with ACL?
I would assume each master would have a unique set of ACLs defining what identity/identities can write to them. The replication stanza would use its own unique DN that has full read access on whatever master it talks to. Write operations read in via syncrepl are done at an internal admin level, so it has full write access to its own DB.
--Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration