The SAP Cloud Connector is the primary component for establishing a secure and reliable connection between applications in SAP BTP and on-premise systems. It acts as a reverse invoke proxy, creating a secure TLS tunnel from the on-premise network to the cloud. This architecture avoids the need to open inbound ports in the on-premise firewall, ensuring that the on-premise systems are not exposed to the internet. All requests from the cloud to the on-premise system are routed through this secure tunnel, providing a principal propagation mechanism to forward the cloud user's identity securely.

A. The Destination Service consumes the connection established by the Cloud Connector but does not create the secure tunnel itself.

C. The HTML5 Application Repository is a service for storing and serving static front-end application content, unrelated to on-premise connectivity.

D. The Authorization Service (XSUAA) manages user authorizations and permissions within cloud applications, not network connectivity.

1. SAP Help Portal, Connectivity in the Cloud Foundry Environment, "SAP Cloud Connector". (This is the main documentation page detailing the purpose and architecture of the Cloud Connector as a link between on-demand applications and on-premise systems).

2. SAP Help Portal, SAP Business Technology Platform Connectivity, "Cloud Connector", Section: "Key Features and Benefits". (This section explicitly states that the Cloud Connector provides "Secure and reliable connectivity to on-premise systems").