3452851 - Setting up Principal Propagation step-by-step (without Web Dispatcher)

This KBA explains how to set up Principal Propagation authentication in the following scenario:
    BTP ------> SCC --------> Back-end system

Note: If there is a WebDispatcher routing this particular PP connection between SCC and back-end, perform the additional steps from the online help:
 Configure Identity Propagation via SAP Web Dispatcher

"Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental."

• BTP Cloud environment
• SAP Cloud Connector supported versions
• SAP AS ABAP backend system release independent

Principal Propagation, PP, Assertion ticket, Principal, Propagation, pattern, email, e-mail, mail, username, name, authentication, assertion, pop-up, pops up, popup, username, password, back-end, backend, ABAP, SU01, SAP CC, SAP Cloud connector, SAPCC, connector, IDP, sub-account, subaccount, emai, username, e-mail, mail, display_name, login_name, SCC, trusted_reverse_proxy, kernel 7.53, trust_client_with, CERTULE, SSL Server Standard, CA, Certificate Authority, subject pattern, PP, trusted_reverse_proxy, trust_client_with_issuer, trust_client_with_subject, $name, $email, $mail, $display_name, $login_name, PKIX, certificate path, certificate, sample, subject pattern, assertion, SAML, SAML2, BTP, Subject DN, Issuer, SAN, Subject Alternative Names, , KBA , BC-MID-SCC , SAP Cloud Connector On-Demand/On-Premise Connectivity , How To