browser-oidc-group-ip-restricted with restrict.to.ip = 203.0.113.0/24, a documentation range that is never your address. Refused QA020 before the geo guard with the exemption off; admitted with it on, because ipPolicyExempt also exempts from the client address allowlist once the user is known.
| account \ verdict | SA | GB | SA+vpn | none |
|---|---|---|---|---|
| exempt | admitted | admitted | admitted | admitted |
| not-exempt | QA020 | QA020 | QA020 | QA020 |
Your address 216.73.216.102: verdict none (no entry: the stand-in answers 404). The account's exemption: off. Switch them on the lab page.
The exemption covers both IP allowlists, not only the geo guard: qa docs/access-checks.md:69-75, docs/ip-allowlist.md:30-33 (rule 2); src/ipallowlist/ClientIpAllowlistAuthenticator.java:53-61. The check sits after the password or the cookie, so the user is known (cfg modules/auth_flows/flows.tf:109-160); exempt then skips the guard as well. Not exempt: QA020 (ClientIpAllowlistAuthenticator.java:72-74) before the guard, so the verdict does not matter. Lab: cfg tests/plugins/test_adversarial_plugins.py:278 (QA020, then admitted once ipPolicyExempt=true), test_functional_plugins.py:45; rep scenarios.yaml:73.