I'm looking to deploy 389 Directory in my environment to replace an existing iPlanet installation. I would be using it primarily to store user account data for authentication purposes. I have two physically separate data centers that I would like to share the same directory tree. My initial thinking is to setup 389 DS as follows:

-A Master/Consumer in DataCenter A

-A Master/Consumer in DataCenter B

-Replication agreement between both masters, to mirror the directory tree in both environments.

Does this sound like a reasonable approach? Is there a better way to do it? (ie: four masters?) Is there documentation for best practices when setting up 389 DS in situations such as this?

Thanks.