net-nds/openldap/openldap-2.4.30.ebuild on line 434 says: DEFS="-DDO_SAMBA -DDO_KRB5" Since the shadowLastChange patch was merged (2.4.28 IIRC), ebuild should enable -DDO_SHADOW. This flag was accounted for in patches (see diff -u files/openldap-2.4.{19,28}-contrib-smbk5pwd.patch), but ommitted in ebuild.
Done in 2.4.31