Configuring Principal Propagation Using the Advanced Adapter Engine 
You can configure principal propagation using the Advanced Adapter Engine (AAE) interconnected between sender and receiver.
Note
The following description always assumes that there is an AAE located between the sender and the receiver.
This scenario can be implemented in one of the following cases:
You use the Advanced Adapter Engine Extended as installation option.
You use the dual-stack installation option of SAP NetWeaver PI and configure local message processing by the AAE.
You can configure principal propagation on the basis of authentication assertion tickets (as authentication method).
Note
This option is supported by the SOAP and RFC adapter.
Procedure
Configuring principal propagation in general involves the following tasks:
Configuring involved back-end systems (for sender and receiver)
Configuring a trust relationship for involved components
Special configuration tasks for sender components
The following sections provide detailed information on these tasks.
One example set up is illustrated in the following figure.
Propagating Identities From a Sender to a Receiver With an AAE Interconnected
In this set up, a user context is propagated from a sender component to a receiver component with an AAE interconnected. Two communication paths have to be configured. On the first communication path (in the figure at left), the sender (acting as client) calls the AAE (acting as server). On the second communication path (in the figure at right), the AAE acts as client when calling the receiver (acting as server).
Configuring Back-End Systems Based on AS ABAP
For involved sender or receiver component that are based on AS ABAP, perform the steps as described under Enabling Principal Propagation for ABAP Messaging Components.
Configuring a Trust Relationship for Involved Components
The AAE supports principal propagation based on SAP assertion tickets. For all involved components, you have to perform configuration steps as described in detail under Configuring a Trust Relationship for SAP Assertion Tickets.
Note
The configuration procedure depends on the underlying stack (AS ABAP or AS Java) and on whether the component acts as client or as server on a specific communication path. Therefore, refer to the corresponding sub chapter in the section linked to above.
For example, for the configuration of sender components based on AS Java, refer to sub section AS Java: Client Side (under Procedure). The same sub section applies for the configuration of the AAE in order to send messages to a receiver component (right hand communication path in figure above).
Sender-Specific Configuration Steps
For sending components (left hand side in figure above), the following configuration steps are necessary – depending on the used communication protocol.
More information: Configuring the Sender
Configuration Steps in the Integration Directory
In the Integration Directory, specify between which entities principal propagation is to take place.
Follow the sequence of tasks as described under: Setting Up Scenarios Using Local AAE-Based Message Processing (under 2. Configure Integration Content).
If you would like principal propagation to occur between a sender and a receiver using the AAE, consider the following additional aspects:
Configuration of sender and receiver communication channel.
When you use a SOAP adapter (sender or receiver), as Message Protocol choose XI 3.0.
In the involved SOAP receiver channel, you have the following options to configure connection parameters and authentication (tab General):
You can choose HTTP Destination as Addressing Type.
In that case, configure the relevant destination using SAP NetWeaver Administrator and ensure that this HTTP destination uses Authentication: Assertion Ticket.
You can choose URL Address as Addressing Type.
In that case you have the following options:
Specify the target URL for an SAP receiver system and add the following string at the end of the URL (in field Target URL): &sap-client=<number of client addressed>.
For Authentication Mode, choose Anonymous Logon.
Specify the target URL for an SAP receiver system and skip the &sap-client=<number of client addressed> string at the end of the URL.
In that case, as Authentication Mode, choose Use logon data for SAP system and specify the client of the target system. Leave all other fields under Authentication Data empty.
Implementing principal propagation from the sender to the AAE.
In the corresponding integrated configuration, on the Inbound Processing tab page select the Principal Propagation check box. If this check box is selected, the signature of the sender ticket is verified and the corresponding user can log on to the AAE.
NoteThe check box is only displayed if you have assigned the integrated configuration a sender communication channel with the appropriate adapter type.
End of the note.Implementing principal propagation from the AAE to the receiver.
In the corresponding integrated configuration, select the Principal Propagation check box on the Outbound Processing tab page.
NoteThe check box is only displayed if you have assigned the integrated configuration a receiver communication channel with the appropriate adapter type.
End of the note.
Recommendation
It is recommended that you select both check boxes (on the Inbound Processing and on the Outbound Processing tab page) to ensure an end-to-end configuration of principal propagation.
In case that, for example, only the check box on the Inbound Processing tab page is selected, the user as configured in the receiver channel is used to call the target system (instead of the intended user which is propagated from the sender to the AAE).