3596112 - Error "401 Unauthorized" when creating a SAP BW/4HANA Model Transfer connection in Datasphere

Symptom

Below error messages are displayed when creating a SAP BW/4HANA Model Transfer connection in Datasphere:

We were not able to retrieve the SAP HANA host, port, and schema from the ABAP server. Please validate the live data connection (tunnel) "XXX" by editing and saving it in the “Data Integration” tab of the “Configuration” display; then try again. You can still enter the host, port, and schema manually, but we recommend you first validate the tunnel connection. If the issue persists, please contact your administrator.
We can provide the following information to assist either you or an SAP engineer to solve the issue:

Correlation ID: XXX
HTTP Status: 500 error
Error Code: tunnelDBInfoErrorTwoTenant
Technical Message: [LCS Service] failed to retrieve the HANA DB information of the BW/4HANA system for live data connection (tunnel) :: XXX. Status Code : 401, Status Message : Unauthorized, Cause: "[String]SSO token validation failed. Make sure trust is configured correctly in the cloud connector to enable principal propagation, if token has not expired yet."

"Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental."

Environment

SAP Datasphere

Reproducing the Issue

Create a SAP BW/4HANA Model Transfer connection in Datasphere.
Select a Tunnel connection in Name dropdown list in "Live Data Connection (Tunnel)" section.