For modular VMs include --add-exports=java.naming/com.sun.jndi.ldap=ALL-UNNAMED

Both the org.wildfly.security.auth.realm.ldap.SimpleDirContextFactoryBuilder class used by the Elytron subsystem dir-context resource, as well as the org.jboss.as.domain.management.connections.ldap.LdapConnectionResourceDefinition used by the core-management ladp-connection resource will by default attempt to instantiate an instance of com.sun.jndi.ldap.LdapCtxFactory. This will fail on SE 16 or later if the relevant module/package is not exported to unnamed modules.

Edit: Soteria also uses com.sun.jndi.ldap.LdapCtxFactory.