dsdb-acl: give error string if we can not obtain the schema