def get_issuer(realm):
    """
    Get correct issuer to validate the JWT against. If an internal URL is
    configured for the server it will be replaced with the public one.

    :param django_keycloak.models.Realm realm:
    :return: issuer
    :rtype: str
    """
    issuer = realm.well_known_oidc['issuer']
    if realm.server.internal_url:
        return issuer.replace(realm.server.internal_url, realm.server.url, 1)
    return issuer
