The SOAP API is deprecated and the tracker SOAP API will definitively be removed in an upcoming Tuleap release. Being able to block accesses to the tracker SOAP API allows to spot users still using the API and help them migrate to the REST API.
A setting in the local.inc file named soap_tracker_whitelisted_users controls the whitelist:
* if this setting is not set, accesses are not blocked
* if this setting is set to an empty string, all accesses are blocked
* if this setting is a comma separated list of usernames, only the users with those usernames are allowed to access the API, e.g. if the setting is set to 'user1,user2' only the users with the username user1 and user2 are allowed.