realmd and adcli allow you to join a domain with a one time password.
That is: a domain administrator can prepare a one time password, and
that one time password can later be used (usually by someone else) to
join a specific computer to the domain.
FreeIPA supports this natively …