A página realm
diz:
It is generally possible to use kerberos credentials to perform a join operation. Use the kinit command to acquire credentials prior to starting the join. Do not specify the --user argument, the user will be selected automatically from the credential cache. The realm respects the KRB5_CCACHE environment variable, but uses the default kerberos credential cache if it's not present. Not all types of servers can be joined using kerberos credentials, some (like IPA) insist on prompting for a password.
Então, se eu entendi direito, apenas adquirir uma credencial Kerberos com kinit
e não adicionar o --useroption
deve funcionar ..