Security

Silly question, but I am brand new to ClearPass and this doesn't make a lot of sense to me.  If the ClearPass server has been added to AD, why does it need a username and password on the Primary when I create my AD as an Authentication Source?

It's used for lookups and authorization. Domain join only handles authentication for legacy authentication methods.