Customer has set ignoreurl parameter in ACO but it didn't works as customer expected.
What customer expect is ignoreURL will match the whole URI starting from "/connection/weblink?pageab=AA_CHANGEPWD".
It means if customer access https://support.ca.com/connection/weblink.htm, it should get challenge and ignoreURL shouldn't match.
However, the IgnoreUrl paramater resulted in anything /connection/weblink* being ignored.
What customer has experienced is by design.
For example, "https://support.ca.com/connection/weblink?pageab=AA_CHANGEPWD" is a [scheme][hostname.domainname][resource/relative_uri][querystring].
The IgnoreUrl applies to the resource/relative_url and does not include the query string, which means only the /connection/weblink will be evaluated.
[Resolved URL: '/html/html2/index.asp'.]
[Auto-authorizing resource, matches IgnoreUrl filter.]