[Freeipa-devel] where should the BindDNGroup be located

[Ludwig Krispenz]

in DS we implemented the feature that in a replica objetct it is 
possible to define a group of bind dns, instead or in addition to the 
use of nsds5ReplicaBindDn. This allows to maintain a group of ldap 
principals ad add new replication agreements without having to modify 
the replication object.
I want to use it in the topology plugin an it will probably be used in 
the 4.2 replioca deployment.

So to start with, if I create this group where should it be located in 
the shared tree: below "cn=ipa,cn=etc,$SUFFIX" ? inside cn=masters or 
cn=replicas or in a new container (the replication topology info is in 
cn=topology, cn=ipa,cn=etc,... ) or in cn=groups,cn=accounts,... ?

Thanks for suggestions,
Ludwig