Where is the point of authentication in system landscapes with central user administration

Hi,

I’am just asking myself where the authentication process is happening when you logon to a SAP childsystem where user accounts are managed on another system with central user administration?

Is it the child system? Is it the cua? Or does it depend on individual configuration?

I asked 2 different AIs and both gave me contradictionary answers.

Thank you for your input