The realm's flow, and the client scope qiwa-claims-examples from keycloak-qiwa-access environments/claims.yaml. After sign-in the decoded tokens carry qiwa.region, qiwa.tier, qiwa.login, qiwa.client_kind and qiwa.geo.country - computed from the geo guard's facts of this login, the account's roles and groups, and the client. Switch the conditions and sign in again: the region follows the verdict (exempt gives unchecked).
| account \ verdict | SA | GB | SA+vpn | none |
|---|---|---|---|---|
| exempt | admitted | admitted | admitted | admitted |
| not-exempt | admitted | QA023 | QA024 | QA022 |
Your address 216.73.216.102: verdict none (no entry: the stand-in answers 404). The account's exemption: on. Change them on the lab page.
Admission is geo-saudi-only's (the realm's flow). The claims: keycloak-qiwa-access environments/claims.yaml (examples) and qiwa-access docs/claims.md (the rules language, the geo facts). Needs the plugin image with qiwa-claim-rules-mapper and the configuration that declares the scope applied before setup_clients.py runs.