For SASL this will be the server name passed in to the factory, for HTTP this should be derived from the Host header in the request.

HTTP mechanisms will need to be double checked as this can only happen after the request is received from the client i.e. Basic authentication will need to wait until the request is received before the mechanism realms can be identified.