## 7.4.1  Principal Propagation from the Neo Environment to the Multi-Cloud Foundation
Enable an application in your subaccount in the Neo environment to access another application in a multienvironment subaccount (for the multi-cloud foundation) without user login (and user interaction) in the second application. For this scenario to work, the two subaccounts need to be in mutual trust, and in trust with the same SAP Cloud Identity Services tenant. The second application will propagate its logged-in user to the first application using an OAuth2SAMLBearer destination.
The graphic below illustrates the overall setup of the scenario.
<!-- image -->
## Prerequisites
- You have a user account with Administrator role in both SAP BTP subaccounts. See Managing Member Authorizations in the Neo Environment.
- You have a custom local service provider configuration (signing keys and certificates, etc.) in your subaccount in the Neo environment. See Configure the Local Service Provider.
- Both accounts have a trust configuration to the same SAP Cloud Identity Services tenant. See:
- Identity Authentication Tenant as an Application Identity Provider (for the Neo environment)
- Manually Establish Trust and Federation Between SAP Authorization and Trust Management Service and SAP Cloud Identity Services [page 2302] (for the multi-cloud foundation)
- You have developed and deployed both applications, each in the corresponding subaccount.
##  Note
All configuration steps described in this tutorial are done using the SAP BTP cockpit.
## Requirements to the Application in the Neo Environment
The application is running on a Java Web Tomcat 9 runtime.
In the source code, the application needs to reference the destination that we are about to create as a later step. The sample source code below illustrates a complete servlet working with the destination with name pptest .
```
package com.sap.cloud.samples; import java.io.BufferedReader; import java.io.IOException; import java.io.InputStreamReader; import java.net.URL; import java.net.URLConnection; import java.security.KeyStore; import java.util.List; import javax.naming.Context; import javax.naming.InitialContext; import javax.net.ssl.HttpsURLConnection; import javax.net.ssl.SSLContext; import javax.net.ssl.SSLSocketFactory; import javax.net.ssl.TrustManagerFactory; import javax.servlet.ServletException; import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import com.sap.core.connectivity.api.authentication.AuthenticationHeader; import com.sap.core.connectivity.api.authentication.AuthenticationHeaderProvider; import com.sap.core.connectivity.api.configuration.ConnectivityConfiguration; import com.sap.core.connectivity.api.configuration.DestinationConfiguration; @WebServlet("/neotocf") public class NeoToCF extends HttpServlet { private static final long serialVersionUID = 1L; private static final Logger LOGGER = LoggerFactory.getLogger(NeoToCF.class); private static final String ON_PREMISE_PROXY = "OnPremise"; protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { response.getWriter().println("Served to: " + request.getUserPrincipal().getName()); try { // Look up the connectivity configuration API Context ctx = new InitialContext(); ConnectivityConfiguration configuration = (ConnectivityConfiguration) ctx .lookup("java:comp/env/connectivityConfiguration"); // Get destination configuration DestinationConfiguration destConfiguration = configuration.getConfiguration("pptest"); if (destConfiguration == null) { response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, String.format( "Destination %s is not found. Hint:" + " Make sure to have the destination configured.", "pptest")); return; } AuthenticationHeaderProvider authHeaderProvider = (AuthenticationHeaderProvider) ctx .lookup("java:comp/env/myAuthHeaderProvider"); // retrieve the authorization header for OAuth SAML Bearer principal propagation List<AuthenticationHeader> samlBearerHeader = authHeaderProvider .getOAuth2SAMLBearerAssertionHeaders(destConfiguration); LOGGER.debug("JWT token from CF XSUAA: " + samlBearerHeader.get(1).getValue()); // get the configured truststore
```
```
KeyStore trustStore = destConfiguration.getTrustStore(); // create sslcontext TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); tmf.init(trustStore); SSLContext sslcontext = SSLContext.getInstance("TLS"); sslcontext.init(null, tmf.getTrustManagers(), null); SSLSocketFactory sslSocketFactory = sslcontext.getSocketFactory(); // get the destination URL String value = destConfiguration.getProperty("URL"); URL url = new URL(value); // use the sslcontext for url connection URLConnection urlConnection = url.openConnection(); ((HttpsURLConnection) urlConnection).setSSLSocketFactory(sslSocketFactory); urlConnection.setRequestProperty(samlBearerHeader.get(0).getName(), samlBearerHeader.get(0).getValue()); urlConnection.setRequestProperty(samlBearerHeader.get(1).getName(), samlBearerHeader.get(1).getValue()); urlConnection.connect(); response.getWriter().println("Received from CF:"); BufferedReader in = new BufferedReader(new InputStreamReader( urlConnection.getInputStream())); String inputLine; while ((inputLine = in.readLine()) != null) response.getWriter().append(inputLine); in.close(); } catch (Exception e) { // Connectivity operation failed String errorMessage = e.getMessage(); LOGGER.error("Connectivity operation failed", e); response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, errorMessage); } } protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { doGet(request, response); } }
```
## Requirements to the Application in the Multi-Cloud Foundation
In the multi-cloud foundation, you need an application following the XSA security model (protected with SAML, UAA service binding using JWT token needed, roles configured in the xs-security.json ).
## See:
- Application Router [page 439]
- Building Roles and Role Collections for Applications [page 2361]
##  Note
You can use the XSA Security Sample Application in GitHub (instructions and code) to develop and deploy an application compliant with the above requirements.