Quoting from [1]:

DEBUG [org.wildfly.security] (default task-1) Could not create [class javax.naming.ldap.InitialLdapContext]. Failed to connect to LDAP server.: javax.naming.NamingException: WFLYNAM0027: Failed instantiate InitialContextFactory "com.sun.jndi.ldap.LdapCtxFactory" from classloader ModuleClassLoader for Module "deployment.print-roles.war" from Service Module Loader [Root exception is java.lang.ClassNotFoundException: "com.sun.jndi.ldap.LdapCtxFactory" from [Module "deployment.print-roles.war" from Service Module Loader]]
at org.jboss.as.naming.InitialContext.getDefaultInitCtx(InitialContext.java:120)
at org.jboss.as.naming.InitialContext.init(InitialContext.java:101)

We can see from the stack trace the deployments class loader is being used.

I think by default the ClassLoader of the subsystem should be used i.e. that will have the common dependencies. However we may want to also add a module attribute so an alternative module can be specified for when creating the InitialDirContext.

[1] https://issues.jboss.org/browse/JBEAP-8025?focusedCommentId=13370291&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-13370291