3729595 - Authentication error HTTP 401 raises from ICM trace while receiving Principal Propagation requests from SCC

While setting up Principal Propagation across SCC and SAP AS ABAP backend system, even though both connection and principal propagation certificates are properly maintained without raising any issue, HTTP 401 authentication error persists.

====

[Thr 140354397636352] CONNECTION (id=xxx/xxxx636):
    used: 1, type: default, role: Server(1), stateful: 0
    NI_HDL: 223, protocol: HTTPS(2)
    local host:  xx.xx.xx.xxx:xxxx ()
    remote host: xx.xx.xx.xxx:xxxxx ()

[Thr 140354397636352] IcmIConnPeekSni: Peek found SNI name xxxx.xxxxxxxxxx.xxxxxxxxxx
[Thr 140354397636352] IcmSslConfigStore::getCredHdl: Returning default cred hdl for SSL config '-' with SNI 'xxxxxx.xxxxxxxxx.xxxxxxxxxx'
[Thr 140354397636352] ->> SapSSLSessionInit(&sssl_hdl=7fxxxxxxxx, role=2 (SERVER), auth_type=1 (ASK_CLIENT_CERT))

54397636352] HttpIsReverseProxyTrustworthy: intermediary is trusted
[Thr 140354397636352] HTTP request (raw) [xxx/xxxx636/1]:
[Thr 140354397636352]   GET /sap/opu/odata4/sap/xxxxxxx/attachments?sap-client=100 HTTP/1.1

[Thr 140354397636352] HTTP request [xxx/xxxx636/1] Accept trusted forwarded certificate (received via HTTPS with trusted certificate): subject="CN=xxxxxxxxxx@xxxxxx", issuer="C=xx, O=xxxxxxxxxxx, OU=xxxxxxx, CN=xxxxxxxxxxxxxxxxx"

[Thr 140354397636352] HTTP response (raw) [xxx/xxxxx636/1]:
[Thr 140354397636352]   HTTP/1.1 401 Unauthorized
[Thr 140354397636352]   set-cookie: sap-ssolist=xxxxxxxxxxxxxd; path=/
[Thr 140354397636352]   set-cookie: sap-usercontext=sap-client=100; path=/
[Thr 140354397636352]   content-type: text/html; charset=utf-8
[Thr 140354397636352]   content-length: 9306

====

• SAP Cloud Connector(SCC);
• Business Technology Platform(BTP);
• SAP AS ABAP Backend system.

SAP cloud connector, CC, SCC, connector, cloud connector, Principal propagation, PP, authentication, certrule, logon with, certificate, X.509, authentication type, subject pattern, pattern, sample certificate, intermediary is trusted, ask_client_cert , KBA , BC-MID-SCC , SAP Cloud Connector On-Demand/On-Premise Connectivity , BC-SEC-LGN , Authentication , Problem