13.12. Access Control and Replication

ACIs are stored as attributes of entries;therefore, if an entry containing ACIs is part of a replicated database, the ACIs are replicated like any other attribute.
ACIs are always evaluated on the Directory Server that services the incoming LDAP requests. This means that when a consumer server receives an update request, it returns a referral to the supplier server before evaluating whether the request can be serviced on the supplier.