I have set up Access for my domain (*.taft.house) and have successfully tested Google Authentication. Google is my login method and I have created an Access Policy that denies everyone except my email address.
The kicker is that I can still connect straight to subdomains (for example, jelly.taft.house) from any browser without being challenged for authentication. This has been tested on private browsing windows and I haven’t seen a login page yet.
Is there anything that I’m missing here? I haven’t set up Argo or validating JSON web tokens. Cheers!