Security & GRCadvanced

Securing Destinations, Cloud Connector and Principal Propagation (Part 4)

Key takeaway

Secure BTP-to-on-premise connectivity by separating destination configuration, Cloud Connector tunnel/resource exposure, trust and authentication, and principal propagation so connectivity does not become authorization bypass.

Explanation

📌 KEY POINTS
✅ Cloud Connector is a controlled outbound tunnel, not a VPN that exposes everything — systems/resources must be explicitly mapped.
⚠️ A successful tunnel connection does NOT mean the propagated user is authorized — the backend must still enforce its own roles.
💡 A 403 after a working tunnel is not a Cloud Connector failure — it's a backend authorization gap.

━━━━━━━━━━━━━━━━━━━━
▶ 1. DESTINATIONS

Describe how an application reaches a target: URL, proxy type, authentication method, related properties/certificates
Destination administration is privileged — a malicious destination can redirect credentials/tokens or open unintended access paths

━━━━━━━━━━━━━━━━━━━━
⚠️ 2. CLOUD CONNECTOR — WHAT IT ISN'T

Not a VPN exposing everything — administrators explicitly map internal systems/resources
Its own administrative access must be protected

━━━━━━━━━━━━━━━━━━━━
▶ 3. PRINCIPAL PROPAGATION

Preserves an end-user identity from BTP toward an on-premise backend in supported scenarios
Requires configured trust, certificates/assertions, and backend user mapping
Connectivity success ≠ authorization — the backend still enforces its own roles

━━━━━━━━━━━━━━━━━━━━
▶ 4. OTHER AUTH METHODS

OAuth client credentials, certificates, or Basic (where supported) for technical/system-level calls
Choose based on whether the call acts as a technical system or on behalf of a user

━━━━━━━━━━━━━━━━━━━━
▶ STEP BY STEP (TROUBLESHOOTING)

Network tunnel — is Cloud Connector actually connected?
Destination resolution — does it point where you think?
Authentication — is the credential/cert valid?
Identity propagation — is the right user being passed?
Backend authorization — does that user have the role?

✅ CHECKPOINT: explain why a working tunnel plus a 403 error points at the backend, not the network.

Real project scenario

A Fiori app reached on-premise S/4 through Cloud Connector but every user saw the same broad data because the destination used one powerful technical user. The business required user-level authorization. The architecture was changed to supported principal propagation, and S/4 roles once again controlled each user's access.

Common mistakes

Treating Cloud Connector as unrestricted network access.
Assigning broad Destination Administrator rights.
Using a technical user when user identity must be enforced.
Blaming network connectivity for backend 403 errors.
Exposing more internal URL paths than the application needs.

Best practices

Expose only required backend resources.
Limit destination/cloud-connector administrators.
Use end-user propagation when business authorization requires it.
Rotate certificates/secrets.
Diagnose tunnel, auth and backend authorization separately.

Interview angle

Explain destination, Cloud Connector and principal propagation as separate layers. Strong answers say the backend still authorizes the propagated user and that resource exposure should be least privilege.

Practice this lesson

Quick check

1. Scenario — A Fiori app reached on-premise S/4 through Cloud Connector but every user saw the same broad data because the destination used one powerful technical user. For the lesson "Securing Destinations, Cloud Connector and Principal Propagation", which response shows the strongest architecture and production judgment?

2. A cloud application needs to call an on-premise SAP ERP system while forwarding the identity of the logged-on cloud user so that the on-premise system performs authorization checks for that specific user. Which mechanism enables this scenario using the Cloud Connector?

3. An administrator wants users to log on to a BTP subaccount using their corporate Active Directory credentials via SAML, instead of the default SAP identity provider. What must be configured in the subaccount's Trust Configuration?

Interview questions

1. You are the senior consultant/architect responsible for Securing Destinations, Cloud Connector and Principal Propagation. The project situation is: A Fiori app reached on-premise S/4 through Cloud Connector but every user saw the same broad data because the destination used one powerful technical user. How would you assess the design, identify the highest-risk failure modes, and define the evidence required before approving it for production?

Answer it in your own words first, then compare.

2. You are the senior consultant/architect responsible for SAP BTP Identity and Trust: Platform Users, Business Users and Identity Providers. The project situation is: A consultant could log into BTP cockpit but could not access an application. How would you assess the design, identify the highest-risk failure modes, and define the evidence required before approving it for production?

Answer it in your own words first, then compare.

Practice more with Interview AI →

Reference-verified: the steps are checked against official SAP documentation and tutorials, and object and field names in the sample code are checked for consistency. The code has not been compiled or run on an SAP system by ERPClimb. Syntax marked release-dependent varies by SAP release, so check it in your own system.