cn=config replication to consumer / slave servers

[Christopher Strider Cook <ccook@pandora.com>]

I have a pair of mirror mode master servers that I would like to be able 
to provide cn=config replication to a series of slave servers, 
primarily, to keep ACLs in sync across servers.

I've tried syncrepl to the cn=config of the primary servers trying to 
exclude certain objects and attributes to prevent the slave from also 
taking the syncprov role. This did not seem to work well enough as I was 
unable to prevent some unwanted entry or another from making it's way 
through and overwriting the syncrepl line itself.

Alternately, I tried to setup a separate database cn=config_slave and 
have that snycrepl to the slave into cn=config... but that creates a 
naming missmatch.

Is there an approved practice to achieve this, or some other pointers on 
avenues to explore?

Thanks,
Chris