Function inferRealmFromIssuer

  • inferRealmFromIssuer(issuer: string): undefined | string

    Attempts to infer the realm path from an OIDC issuer URL.

    AM issuer URLs follow the pattern: https://{host}/am/oauth2/realms/root/realms/{subrealm}

    This function extracts the realm path after /realms/root/realms/. If the issuer doesn't match the expected pattern, returns undefined.

    Parameters

    • issuer: string

      The issuer URL from the well-known response

    Returns undefined | string

    The inferred realm path, or undefined if it cannot be determined

    Example

    // Standard AM issuer with subrealm
    inferRealmFromIssuer('https://am.example.com/am/oauth2/realms/root/realms/alpha')
    // Returns: 'alpha'

    // Nested subrealm
    inferRealmFromIssuer('https://am.example.com/am/oauth2/realms/root/realms/customers/realms/premium')
    // Returns: 'customers/realms/premium'

    // Root realm only
    inferRealmFromIssuer('https://am.example.com/am/oauth2/realms/root')
    // Returns: 'root'

    // Non-AM issuer (e.g., PingOne)
    inferRealmFromIssuer('https://auth.pingone.com/env-id/as')
    // Returns: undefined

Settings

Member Visibility