If single sign-on is enabled for your organization, API and desktop client users cannot log in to Salesforce CRM unless their IP address is included on your organization's list of trusted IP addresses or on their profile, if their profile has IP address restrictions set.