A public client (no secret) that requires PKCE S256, on the realm's flow: the shape of production's account-console. Shows that the client type changes nothing at the login: the geo guard decides, as for geo-saudi-only.
| account \ verdict | SA | GB | SA+vpn | none |
|---|---|---|---|---|
| exempt | admitted | admitted | admitted | admitted |
| not-exempt | admitted | QA023 | QA024 | QA022 |
Your address 216.73.216.102: verdict none (no entry: the stand-in answers 404). The account's exemption: off. Switch them on the lab page.
Public client with S256: cfg environments/prod/prod-clients.yaml:2-21 (account-console: client_authentication false, pkce_code_challenge_method S256), which is Keycloak's client attribute pkce.code.challenge.method (server_admin clients/oidc/con-basic-settings.adoc). Every client without an override logs in through the realm's flow and its guard: cfg modules/auth_flows/flows.tf:164-170. No realm client policy concerns PKCE: cfg client_policies.tf holds only reject-password-grant. Guard as in geo-saudi-only.