Domain membership fails as the discover option is missing an essential package:

tw:~ # realm discover tao.test
tao.test
  type: kerberos
  realm-name: TAO.TEST
  domain-name: tao.test
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: sssd-tools
  required-package: sssd
  required-package: adcli
  required-package: samba-client
  login-formats: %U@tao.test
  login-policy: allow-realm-logins

From the log:

sssd[4560]: Could not exec /usr/libexec/sssd/sssd_pac --uid 0 --gid 0
--logger=files, reason: No such file or directory

Package sssd-ad is missing from the requirements which provides
/usr/libexec/sssd/sssd_pac. Without the package sssd and consequently the
domain membership will fail.