Hi Dan,
It sounds as though the person attempting to enable LDAP enrolment on a course does not have a role with the capability enrol/ldap:manage allowed. It's not allowed for the default teacher role, only the manager role.
Please let us know how your troubleshooting goes. (It seems like the documentation LDAP enrolment could do with improving. )