3596089 - Error "403 Forbidden" when creating a SAP BW/4HANA Model Transfer connection in Datasphere

Below error messages are displayed when creating a SAP BW/4HANA Model Transfer connection in Datasphere:

We were not able to retrieve the SAP HANA host, port, and schema from the ABAP server. Please validate the live data connection (tunnel) "XXX" by editing and saving it in the “Data Integration” tab of the “Configuration” display; then try again. You can still enter the host, port, and schema manually, but we recommend you first validate the tunnel connection. If the issue persists, please contact your administrator.
We can provide the following information to assist either you or an SAP engineer to solve the issue:

Correlation ID: XXX
HTTP Status: 500 error
Error Code: tunnelDBInfoErrorTwoTenant
Technical Message: [LCS Service] failed to retrieve the HANA DB information of the BW/4HANA system for live data connection (tunnel) :: XXX. Status Code : 403, Status Message : Forbidden, Cause: "[String]Access denied to resource https://<virtual host>:<virtual port>/sap/bw4/v1/dwc/dbinfo?sap-client=xxx on system <virtual host>:<virtual port>. In case this was a valid request, ensure to expose the resource correctly in your cloud connector."

"Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental."    

SAP Datasphere

1. Create a SAP BW/4HANA Model Transfer connection in Datasphere.
   
   
2. Select a Tunnel connection in Name dropdown list in "Live Data Connection (Tunnel)" section.
   
   

The service /sap/bw4/v1/dwc/dbinfo cannot be accessed from Datasphere.

1. Find the mapping entry in Cloud Connector by <virtual host>:<virtual port>.
2. Add below resources:
   • /sap/opu/odata/sap/ESH_SEARCH_SRV/SearchQueries
   • /sap/bw4/v1/dwc/dbinfo
   • /sap/bw4/v1/dwc/metadata/queryviews – Path and all sub-paths
   • /sap/bw4/v1/dwc/metadata/treestructure – Path and all sub-paths
   • /sap/bw/ina – Path and all sub-paths
     

Configure Cloud Connector

model import, model import connection , KBA , DS-DI-CON , Connections , Problem