We have a connected app in the manage package, setup for Oauth Web Server flow. We have provided IP ranges using these steps https://help.salesforce.com/articleView?id=connected_app_edit_ip_ranges.htm&type=5 to restrict the access to connected app. However seems connection to connected app is still allowed outside of those IP ranges.
For example: I performed the OAuth Web Server Flow steps using Postman(which is outside of the given IP range), but still I could successfully connect and generate refresh token and access token.
I haven't found any descriptive documentation of this particular behavior. Can someone please provide insights on this?
Thanks in advance for the help.
Further Update:19/08/2020 While playing more around this, I tried below scenario:
- Added IP range in the user profile
- Removed IP trusted IP ranges for OAuth Web Server Flow
- Set connected app policy to - Relax IP restrictions for activated devices
Tried a connection to connected app from different IP (then set in user profile).
Expected: Successful connection, based on criteria
The app doesn’t have a list of allowed IP-ranges, but it uses the web server authentication flow, and the user successfully completes identity verification if accessing Salesforce from a new browser or device.
given in the documentation https://help.salesforce.com/articleView?id=connected_app_continuous_ip.htm&type=5.
Actual: Received IP restricted error, and connection was not successful.
Can someone please clarify if my understanding is not correct regarding above scenario? Thanks in advance!