I didn't get those changes quite right.

If kdb5_util does not find ldap_service_password_file in the realm's 
dbmodules section, it should try in [dbdefaults] before failing out.  
(So, it should not be looking in [dbdefaults] for database_module, but it 
should be looking there for ldap_service_password_file.)