Can Cloud Connector enable mTLS between BTP and my intranet's API Gateway?

[moeka_matsumura]

Hello,

I would like to establish mTLS authentication between BTP and the API Gateway within the intranet, but I can't find any documentation to achieve this. Can mTLS authentication be achieved between BTP and the API Gateway within the intranet using Cloud Connector?
If mTLS authentication is available, is it possible to identify the access user on the Cloud Connector side?
Attached is an image showing the mTLS authentication flow that we would like to achieve.

Thank you.

Best regards,
moeka matsumura

[gregorw · Accepted solution]

That is exactly what Cloud Connector does when you connect to an ABAP System and you would like to enable Principal Propagation. It must be a mTLS connection betwenn CC and the ABAP System. The same can be achieved by any other mTLS capable backend.

[moeka_matsumura · Accepted solution]

Dear  gregorw,

Thank you for your reply.

https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/authenticating-users-against-on-premi...

Is the relevant document the one at the URL above? I will take a look at it.

Best regards,
moeka matsumura

[moeka_matsumura · Accepted solution]

Dear gregorw,

I've registered a mapping for a Virtual To Internal System in Cloud Connector, and its status is "Reachable" (Back-end Type: Non-SAP System, Principal Type: X.509 Certificate). I’ve also imported both the System Certificate and CA Certificate.

In BTP Destinations, I’ve configured the destination with the following settings:

Type: HTTP
URL: https://[Virtual Host set in Cloud Connector]
Proxy Type: OnPremise
Authentication: PrincipalPropagation
However, when my application uses this destination to call an API, I receive the error: {"message":"Domain not found"}.
There were no corresponding error logs recorded in the ljs_trace.log of the Cloud Connector.

Could this be an issue with the backend system?
I’ve already registered the CA Certificate (imported into Cloud Connector) in the backend system. Is this the correct approach?

Best regards,
moeka matsumura

[gregorw · Accepted solution]

Hi Moeka

have you configured "Host In Request Header" to "Use Internal Host":

Best regards,
Gregor

[moeka_matsumura · Accepted solution]

Dear gregorw,

It is working well.
Thank you for your support!