The current LDAP identity driver does not support the notion of 'enabled' for users/tenants and therefore when using LDAP as an identity backend, this functionality is not provided. There is some discussion of this issue in https://bugs.launchpad.net/keystone/+bug/980085 however I don't see the functionality was addressed as part of 980085. Moreover this issue seems like it might be best tracked as its own defect so its not masked in another defect and lost.
Here's a comment from keystone/identity/backends/ldap/core.py regarding this issue:
# NOTE(ayoung): The RFC based schemas don't have a way to indicate
# 'enabled' the closest is the nsAccount lock, which is on defined to
# be part of any objectclass.
# in the future, we need to provide a way for the end user to
# indicate the field to use and what it indicates
THis is probably higher priority than wishlist. It may be that the enabled field is required for most people's LDAP enable. There was info added to the blueprint around 'enable' that wshows how tricky it will be to solve in the general case, though.