3367280 - Principal Propagation : Popup for credentials appears or "401 unauthorized" - Troubleshooting Guide

In Principal Propagation scenario, a popup for credentials (prompt for username and password) appears

or

error "401 unauthorized" happens.

SAP Cloud Connector - Cloud to On-premise + Principal Propagation scenario.

Principal Propagation, PP, Assertion ticket, Principal, Propagation, pattern, email, e-mail, mail, username, name, authentication, assertion, pop-up, pops up, popup, username, password, back-end, backend, ABAP, SU01, SAP CC, SAP Cloud connector, SAPCC, connector, IDP, sub-account, subaccount, emai, username, e-mail, mail, display_name, login_name, SCC, trusted_reverse_proxy, kernel 7.53, trust_client_with, CERTULE, SSL Server Standard, CA, Certificate Authority, subject pattern, PP, trusted_reverse_proxy, trust_client_with_issuer, trust_client_with_subject, $name, $email, $mail, $display_name, $login_name, PKIX, certificate path, certificate, sample, subject pattern, assertion, SAML, SAML2, BTP, Subject DN, Issuer, SAN, Subject Alternative Names, 401, 302, no turst, logon, Reject untrusted forwarded certificate, icm/server_port*, Unauthorized, HttpCertIsReverseProxyTrustworthy, intermediary is NOT trusted, , KBA , BC-MID-SCC , SAP Cloud Connector On-Demand/On-Premise Connectivity , BC-CST-IC , Internet Communication Manager , BC-SEC-LGN , Authentication , Problem