3452851 - Setting up Principal Propagation step-by-step from SAP Cloud Connector

This KBA explains how to set up Principal Propagation authentication in the following scenario:
    BTP ------> SCC ------> AWS ELB (in case) --------> Web Dispatcher --------> Back-end system

Note: If there is a WebDispatcher routing this particular PP connection between SCC and back-end, perform the additional steps from the online help:
 Configure Identity Propagation via SAP Web Dispatcher


In case there is an AWS ELB between SCC and Web Dispatcher:

Context of the Trace (dev_wdisp)

====
Component: SAP ICM (Web Dispatcher / ICM HTTPS listener)
Protocol: HTTPS (TLS)
Role: Server
Client: AWS ELB Health Checker (ELB-HealthChecker/2.0)
Client certificate: Requested but not provided

SSL Session Initialization
SapSSLSessionInit()
role=SERVER, auth_type=ASK_CLIENT_CERT

Network Connection (NI Handle)
local=......
peer=...... (ELB)

Client Certificate Handling
NO client cert
Client certificate info: no certificate received
====
 

Note: "Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental."

• BTP Cloud environment(BTP);
• SAP Cloud Connector(SCC) supported versions;
• SAP AS ABAP backend system release independent.

Principal Propagation, PP, Assertion ticket, Principal, Propagation, pattern, email, e-mail, mail, username, name, authentication, assertion, pop-up, pops up, popup, username, password, back-end, backend, ABAP, SU01, SAP CC, SAP Cloud connector, SAPCC, connector, IDP, sub-account, subaccount, emai, username, e-mail, mail, display_name, login_name, SCC, trusted_reverse_proxy, kernel 7.53, trust_client_with, CERTULE, SSL Server Standard, CA, Certificate Authority, subject pattern, PP, trusted_reverse_proxy, trust_client_with_issuer, trust_client_with_subject, $name, $email, $mail, $display_name, $login_name, PKIX, certificate path, certificate, sample, subject pattern, assertion, SAML, SAML2, BTP, Subject DN, Issuer, SAN, Subject Alternative Names, , KBA , BC-MID-SCC , SAP Cloud Connector On-Demand/On-Premise Connectivity , How To