A SAML client on browser-group-restricted with restrict.to.group = qiwaDevOpsProd, a group the account is not in. Refused QA014, the SAML code, in every condition: the check ignores the exemption and runs before the geo guard.
| account \ verdict | SA | GB | SA+vpn | none |
|---|---|---|---|---|
| exempt | QA014 | QA014 | QA014 | QA014 |
| not-exempt | QA014 | QA014 | QA014 | QA014 |
Your address 216.73.216.102: verdict none (no entry: the stand-in answers 404). The account's exemption: off. Switch them on the lab page.
QA014 on the SAML flow: qa docs/group-membership.md:13-16,35, README.md:70. Order and exemption as group-not-member (cfg modules/auth_flows/flows.tf:48-54,109-117; qa docs/access-checks.md:74-75). rep scenarios.yaml:133.