Specifically the #of method:

https://stash.forgerock.org/projects/OPENAM/repos/openam-sustaining/browse/openam-shared/src/main/java/org/forgerock/openam/core/realms/Realms.java#41

returns the realm in Realm type, instead of a String. This is needed when trying to use annotated service but the calling service doesn't support injection.

For example, PAP doesn't support injection. If it needs to access an annotated service, then it needs to call the #getRealmSingleton method:

getRealmSingleton(Class<T> serviceInterface, Realm realm)

So, one can use 

String realm = DNMapper.orgNameToRealmName(ssoToken.getProperty("Organization"));

and then use Realms.of(realm) to get the realm in Realm type.

The workaround is to create a global service and then use #getGlobalSingleton where Realm is not required, but global service is not always an accepted solution.

It's quite unlikely to update PAP to support injection, so making the #of method would be useful.