browser-oidc-group-ip-restricted with restrict.to.ip = your address/32 and no group named. The address check passes, so the outcome is the geo guard's.
| account \ verdict | SA | GB | SA+vpn | none |
|---|---|---|---|---|
| exempt | admitted | admitted | admitted | admitted |
| not-exempt | admitted | QA023 | QA024 | QA022 |
Your address 216.73.216.102: verdict none (no entry: the stand-in answers 404). The account's exemption: off. Switch them on the lab page.
qa docs/ip-allowlist.md:28-33; src/ipallowlist/ClientIpAllowlistAuthenticator.java:63-68. No restrict.to.group, so the group check is a no-op (src/groupmembership/GroupMembershipAuthenticator.java:58-62). Group, client IP, then the geo guard: cfg modules/auth_flows/flows.tf:69-73,109-117. Guard as in geo-saudi-only. Holds while Keycloak resolves the login to {tester_ip} (see geo-bypass-my-ip); from another address it is QA020 unless exempt (see ip-denied). Lab: cfg tests/plugins/test_functional_plugins.py:45.