title: Insufficient Access Rights: The entry cn=schema cannot be modified due to insufficient access rights
body: <p>I tried to assign an admin user to do the update schema. </p>
  
  <p>Here is the global-aci in</p>
  
  <pre><code>'cn=Access Control Handler,cn=config'
  ds-cfg-global-aci: (target="ldap:///cn=schema")(targetattr="*")(version 3.0; acl "admin user can update schema"; allow (all,import,export) userdn="ldap:///uid=admin,ou=People,ou=Subjects,dc=example,dc=com";)
  </code></pre>
  
  <p>And the admin user has assigned:
  ds-privilege-name: subentry-write
  ds-privilege-name: update-schema</p>
  
  <p>If I give this user one more privilege,</p>
  
  <pre><code>ds-privilege-name: bypass-acl
  </code></pre>
  
  <p>then this 'admin' user can add modify <code>cn=schema</code>, add attributes.</p>
  
  <p>but If I remove <code>'ds-privilege-name: bypass-acl'</code>, then the exception thrown again.</p>
  
  <p>So it is clear that my <code>global-aci</code> doesn't work?
  Do I need any other aci settings for the <code>cn=schema</code>, to enable the user to update schema?</p>