browser-oidc-full-restricted (the per-user check is only in the full flows) with only restrict.to.user.ip = true. The account has no allowedIps, which means unrestricted, so the check admits and the outcome is the geo guard's; QA025 would need an allowedIps value on the account.
| account \ verdict | SA | GB | SA+vpn | none |
|---|---|---|---|---|
| exempt | admitted | admitted | admitted | admitted |
| not-exempt | admitted | QA023 | QA024 | QA022 |
Your address 216.73.216.102: verdict none (no entry: the stand-in answers 404). The account's exemption: off. Switch them on the lab page.
No allowedIps: allowed (qa docs/ip-allowlist.md:52, rule 3; src/ipallowlist/UserIpAllowlistAuthenticator.java:76-80); exempt: allowed before that (:69-74, rule 2). The account has no allowed_ips (cfg environments/companies/qiwa/users.yaml:3-62) and the user module drops a null attribute (cfg modules/user/main.tf:45,64). user-ip-restrictor-auth is only in browser-saml/oidc-full-restricted: cfg modules/auth_flows/flows.tf:75-84. No restrict.to.group or restrict.to.ip here, both no-ops. Guard as in geo-saudi-only. rep personas.yaml:215-216 (allowed-ip-absent), scenarios.yaml:74-75.