replica          uri=ldap[s]://<hostname>[:port]|host=<hostname>[:port]
              [starttls=yes|critical]          [suffix=<suffix>         [...]]
              bindmethod=simple|sasl [binddn=<simple DN>] [credentials=<simple
              password>]    [saslmech=<SASL   mech>]   [secprops=<properties>]
              [realm=<realm>]          [authcId=<authentication           ID>]
              [authzId=<authorization ID>] [attr[!]=<attr list>]
              Specify  a  replication  site  for  this database.  Refer to the
              "OpenLDAP Administrator's Guide"  for  detailed  information  on
              setting  up  a  replicated slapd directory service. Zero or more
              suffix instances can be used to select the subtrees that will be
              replicated  (defaults  to all the database).  host is deprecated
              in favor of the uri option.  uri allows the replica LDAP  server
              to be specified as an LDAP URI.  A bindmethod of simple requires
              the options binddn and credentials and should only be used  when
              adequate  security  services  (e.g TLS or IPSEC) are in place. A
              bindmethod of  sasl  requires  the  option  saslmech.   Specific
              security  properties  (as  with the sasl-secprops keyword above)
              for a SASL bind can be set with  the  secprops  option.  A  non-
              default  SASL  realm  can  be set with the realm option.  If the
              mechanism will use Kerberos, a kerberos instance should be given
              in authcId.  An attr list can be given after the attr keyword to
              allow the selective replication of the listed  attributes  only;
              if  the  optional  !   mark  is  used,  the  list  is considered
              exclusive, i.e. the listed attributes are not replicated.  If an
              objectClass  is listed, all the related attributes are (are not)
              replicated.