The realm refuses to even create a client with the password grant on, so this client has it off; /password-grant tries grant_type=password with the realm's built-in admin-cli, which still has it on, and shows the policy's own answer. Refused in every condition by the realm's reject-password-grant client policy: the grant never runs the browser flow, so neither the exemption nor the verdict plays a part.
| account \ verdict | SA | GB | SA+vpn | none |
|---|---|---|---|---|
| exempt | refused | refused | refused | refused |
| not-exempt | refused | refused | refused | refused |
Your address 216.73.216.102: verdict none (no entry: the stand-in answers 404). The account's exemption: off. Switch them on the lab page.
Policy: Keycloak's reject-ropc-grant on every client of the realm, auto-configure off: cfg client_policies.tf:3-13,33-60, on by default (cfg environments/keycloak-general-config/security-defenses.yaml:105-110). Its answer: 400 invalid_grant with 'prohibited' in error_description (cfg tests/plugins/test_password_grant_policy.py:25-48). The browser checks never run for this grant: qa docs/access-checks.md:97. SETUP: with auto-configure off the same policy refuses to create or save a client with direct grants on (400 invalid_client_metadata): cfg client_policies.tf:10-13, test_password_grant_policy.py:60-78; the realm's built-in admin-cli still has the grant on and shows the policy's own answer (test_password_grant_policy.py:44-48). Unverified: which refusal the page shows with dummy credentials (the policy, the client's switch, or the credentials), since that order is Keycloak's token endpoint, not in these repositories; every path ends refused. [Sign in] still uses the realm's browser flow, with geo-saudi-only's matrix.