SAP BTP Principal Propagation & OAuth User Token Exchange Architecture Guide

1. The Technical Service User Vulnerability

When integrating SAP BTP extensions with S/4HANA, architects frequently take the shortcut of configuring Basic Authentication using a technical service user (e.g. RFC_SERVICE_USER). In enterprise production environments, this represents a severe security and compliance vulnerability:

• Audit Log Blindness: Database change logs (`CDHDR`), RAP audit trails, and financial document headers all record SY-UNAME = RFC_SERVICE_USER. Proving who authorized a payment or modified a supplier bank account during SOX or GDPR audits becomes impossible.
• Authorization Escalation: The technical service user requires broad RFC and business authorizations to serve all potential requests. If a front-end user lacks permission to view sales figures in S/4HANA, the service user's broad permissions bypass PFCG role checks entirely!

2. How Principal Propagation Works

Principal Propagation forwards the authentic human identity from the BTP user session into S/4HANA without requiring the user to re-enter credentials:

3. Cloud Connector X.509 Certificate Generation

When a BTP application issues an HTTP call via the Destination Service with Authentication = PrincipalPropagation:

1. The BTP Destination Service sends the user's short-lived JWT to the Cloud Connector over mutual TLS.
2. The Cloud Connector extracts the user identity claim (e.g. email or username) and mints a short-lived (2-minute) X.509 client certificate signed by its Subaccount CA.
3. The Cloud Connector opens a reverse-invoke HTTPS tunnel to S/4HANA, presenting the X.509 certificate in the TLS handshake.
4. S/4HANA validates the certificate signature against STRUST and matches the subject CN to an active SU01 user via CERTRULE.

4. Clean Core ABAP Cloud Consumption

In ABAP Cloud Tier-1, developers never handle certificates or passwords manually. Destination resolution is handled cleanly by the framework:

DATA(lo_dest) = cl_http_destination_provider=>create_by_cloud_destination( 'S4HANA_PROPAGATION_DEST' ).
DATA(lo_client) = cl_web_http_client_manager=>create_by_http_destination( lo_dest ).
DATA(lo_response) = lo_client->execute( if_web_http_client=>get ).