Description of problem: Enabling DNA plugin throws the following error.

modifying entry "cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config"
ldap_modify: Server is unwilling to perform (53)
additional info: Changes result in an invalid DNA configuration.

Steps to Reproduce:
1. Install 389-ds-base-1.2.11.15-26 and run ldapmodify to enable DNA plugin.
2. Run ldapmodify to enable the DNA plug-in:

dn: cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config
changetype: modify
replace: nsslapd-pluginEnabled
nsslapd-pluginEnabled: On

1. Restart DS to load hte DNA plug-in.
2. Run the same ldapmodify again.

Actual results: The plug-in is enabled at first, but the consecutive attempts
returns error 53.

modifying entry "cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config"
ldap_modify: Server is unwilling to perform (53)
additional info: Changes result in an invalid DNA configuration.

It looks like any change to the main DNA config entry when DNA is enabled is rejected at the pre-op stage in dna_parse_config_entry():

/* If this is the main DNA plug-in
- config entry, just bail. */
if (strcasecmp(getPluginDN(), slapi_entry_get_ndn(e)) == 0) {
    ret = DNA_FAILURE;
    goto bail;
}

Returning DNA_FAILURE will cause LDAP_UNWILLING_TO_PERFORM to be returned to the client. The purpose of dna_parse_config_entry() is to validate range config entries, which are children of the main DNA config entry. We want to skip validation of the main DNA config entry, but we shouldn't be rejecting the operation. I believe that the above code snippet should just return DNA_SUCCESS to allow validation to be skipped for the main DNA config entry.