Description of problem:

It is not possible to use the SASL EXTERNAL mechanism in order to update the cn=config database due to restricted ACLs stored in the LDAP directory.

Indeed, the default ACLs deployed in the cn=config database are : 
{0}to * by * none.

Version-Release number of selected component (if applicable): openldap-2.4.24-3.fc15.i686

How reproducible:

Try to insert a schema in the cn=config database with the SASL EXTERNAL mechanism with the following command : 
ldapadd -Y EXTERNAL -H ldapi:/// -f <schema_file>
 
Actual results:

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=goto,cn=schema,cn=config"
ldap_add: Insufficient access (50)

Expected results:

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=goto,cn=schema,cn=config"

Additional info: Having the following ACL by default would resolve this issue : 

olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=externalcn=auth manage by * break