browser-oidc-group-restricted with restrict.to.group = qiwaDevOpsSuper, a group the account is in. The group check passes, so the outcome is the geo guard's, which ends this flow too.
| account \ verdict | SA | GB | SA+vpn | none |
|---|---|---|---|---|
| exempt | admitted | admitted | admitted | admitted |
| not-exempt | admitted | QA023 | QA024 | QA022 |
Your address 216.73.216.102: verdict none (no entry: the stand-in answers 404). The account's exemption: off. Switch them on the lab page.
Member: cfg environments/companies/qiwa/users.yaml:27; group: cfg environments/groups/groups.yaml:2-7 (unique name, so the bare name resolves). Rule: qa docs/group-membership.md:18-35, src/groupmembership/GroupMembershipAuthenticator.java:85-88,138-152. Group check, then the geo guard, on both paths: cfg modules/auth_flows/flows.tf:56-61,109-117. Guard as in geo-saudi-only. rep personas.yaml:46-49 (dummy-group-restricted), scenarios.yaml:57. Lab: cfg tests/plugins/test_functional_plugins.py:29.