There are methods in Elytron LdapSecurityRealm class which create/get DirContext, but does not close him in finally block.
In some circumstances could cause context resource leak.

• LdapSecurityRealm
  • getEvidenceVerifySupport
  • getCredentialAcquireSupport
  • getCredential
  • setCredentials

• LdapRealmIdentity
  • setCredentials

In same class there are examples of properly closed contexts:

• LdapRealmIdentity
  • getCredential
  • getEvidenceVerifySupport
  • verifyEvidence
  • getIdentity
  • create
  • setAttributes