browser-oidc-group-restricted with restrict.to.group = qiwaDevOpsProd, an existing group the account is not in. Refused QA015 in every condition: the group check ignores the exemption and runs before the geo guard, so no lookup is made.
| account \ verdict | SA | GB | SA+vpn | none |
|---|---|---|---|---|
| exempt | QA015 | QA015 | QA015 | QA015 |
| not-exempt | QA015 | QA015 | QA015 | QA015 |
Your address 216.73.216.102: verdict none (no entry: the stand-in answers 404). The account's exemption: off. Switch them on the lab page.
QA015 on the OIDC flow: qa docs/group-membership.md:13-16,35; src/groupmembership/GroupMembershipAuthenticator.java:90-92. Not an IP-based check, ignores ipPolicyExempt: qa docs/access-checks.md:74-75. Group before guard: cfg modules/auth_flows/flows.tf:109-117. qiwaDevOpsProd: cfg environments/groups/groups.yaml:8-13, not in users.yaml:14-43; no group has a parent, so no inherited membership (group-membership.md:32-34). A fresh login asks for the password and second factor first (flows.tf:136-158); a returning session is refused straight after the cookie. Lab: cfg tests/plugins/test_functional_plugins.py:29; rep scenarios.yaml:58.