2656195 - SAP Cloud Connector error with Neo subaccount: -"Denied access for tunnel with id"

• The error below is encountered by an application running on SAP Cloud Platform while establishing a connection to an on-premise system:

Cannot open tunnel with id account://...
or
Could not connect to Cloud Connector

Example from the SAP Web IDE:

Example from CPI:

• The following error is recorded in the SAP Cloud Connector ljs_trace.log (<2.17)/ scc_core.trc (>=2.17) logs:

"#ERROR#com.sap.core.connectivity.tunnel.client.notification.NotificationClientEventHandler#Thread-103# #Denied access for tunnel with id 'account:///<AccountName>' and attributes: 'applicationAccount:<Account>, applicationName:<Name>, applicationType:<type>'"

*Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental

• SAP Cloud Platform.

• SAP Cloud Connector release independent.

scc, deploy, abap, backend, on-premise, on-premises, webide, service unavailable, Denied access for tunnel with id, sap analytics cloud, sac, s4hana, import connection, cloud connector, tunnel connection error, denied access, scc_config.ini, trustedApplications, application tab missing, cloud connector upgrade, error message, CF, subaccount, KBA 2656195, OS level file, scc_config.ini, trustedApplications class, configuration error, Cloud Connector, subaccount configuration, clear old configuration, restart SAP Cloud Connector, backup scc_config.ini, SCC installation corruption, CF subaccount tunnel, Cloud Foundry application, on-premise system connection, ljs_trace.log, scc_core.trc, TunnelNotAllowedException, tunnel ID, applicationType Cloud Foundry, applicationAccount, applicationName, cpi, , KBA , BC-MID-SCC , SAP Cloud Connector On-Demand/On-Premise Connectivity , Problem