Keep in mind that the username on the Realm Configuration page is not LDAP, it is Kerberos. Be sure that tcp/udp 88 and 464 is permitted.
Other things to consider are from the following output of the 7.2.x administration guide:
AD Join Username and AD Join Password
(Available on the Realm Configuration tab page when you edit a realm.)
For Microsoft Active Directory realms intended for Kerberos captive portal active authentication, the distinguished username and password of any Active Directory user with appropriate rights to create a Domain Computer account in the Active Directory domain.
Keep the following in mind:
DNS must be able to resolve the domain name to an Active Directory domain controller's IP address.
The user you specify must be able to join computers to the Active Directory domain.
The user name must be fully qualified (for example, administrator@mydomain.com, not administrator).
If you choose Kerberos (or HTTP Negotiate, if you want Kerberos as an option) as the Authentication Protocol in an identity rule, the Realm you select must be configured with an AD Join Username and AD Join Password to perform Kerberos captive portal active authentication.
https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/720/management-center-device-config-72/identity-realms.html#task_F9ED2AF84F604438ACDC2124237DC518
--
Please remember to select a correct answer and rate helpful posts
