This bug is created as a clone of upstream ticket:
https://fedorahosted.org/389/ticket/47527

 The referential integrity plug-in currently doesn't allow you to restrict the suffixes it applies to. It would be nice to be able to list the suffixes to include or exclude for referential integrity operations operations.

The specific scenario where this would be useful is when a MODRDN operation is performed to move an entry.  If an entry is moved outside of the scope of the referential integrity plug-in, any references to that entry should be removed.

When an entry outside of the scope of the referential integrity plug-in is deleted, we don't need to bother searching for references at all.

The difficulty with implementing this is that the current way we configure the referential integrity plug-in uses an argc/argv approach.  This doesn't lend itself well to remaining backwards compatible.  If we need to add new suffix scoping config attributes, they should be actual named configuration attributes so we can leave the existing configuration attributes as-is.  We could also add the ability to use an alternate config area and convert entirely to named config attributes if an alternate config area is being used, but retain the argc/argv approach if the configuration is in the main config entry.

This functionality is needed by FreeIPA for a user provisioning feature that is being designed.