The appropriate conclusion is that the permissions module determined that the caller was, in fact, in the trusted table, possibly due to incorrect, ambiguous or wildcard data (subnet matching?).
Asim Riaz wrote:
Hi Alex,
What I was trying to say caller’s IP wasn’t in the Trusted table but he didn’t receive challenge from proxy and was able to bypass authentication like my other trusted users which are in the trusted table.
Thanks,
Asim