browser-oidc-group-restricted with restrict.to.group naming a group the realm does not have. Shows that a mistyped group fails closed, QA015 for everyone, rather than opening the client.
| account \ verdict | SA | GB | SA+vpn | none |
|---|---|---|---|---|
| exempt | QA015 | QA015 | QA015 | QA015 |
| not-exempt | QA015 | QA015 | QA015 | QA015 |
Your address 216.73.216.102: verdict none (no entry: the stand-in answers 404). The account's exemption: off. Switch them on the lab page.
A name that matches nothing is skipped; a list of only unknown groups admits nobody: qa docs/group-membership.md:31,35; src/groupmembership/GroupMembershipAuthenticator.java:112-118 then :90-92. The name is in no groups.yaml entry (cfg environments/groups/groups.yaml). Order and exemption as group-not-member.