Following attributes Elytron ldap-realm are nillable=false but have set default values:

• identity-mapping.use-recursive-search
• identity-mapping.user-password-mapper.writable
• identity-mapping.user-password-mapper.verifiable

Using nillable=false with set default value can be confused (because default value should be used in case when none value is set and nillable=false says that any value must by used).

Suggestion:
Since none of these mentioned attributes is required by CLI commands set nillable for these attributes to true.