A method of authenticating a user to a service in a system having a connection broker that manages connections to the service, comprising: receiving an input of credentials of the user at a client computing device that communicates with the connection broker and with the service over a network, wherein the connection broker is configured to manage connections to a plurality of resources and the service is running in one of the resources, and wherein the user credentials include a secret component; securely storing the secret component in the client computing device; authenticating, using the user credentials, the user of the client computing device to grant access to the client computing device upon successful authentication, wherein the authentication of the user is performed by a domain controller; after the user has successfully accessed the client computing device, displaying a user interface on the client computing device and detecting an input from the user to access the service using the same user credentials which were used to access the client computing device; responsive to the user input at the client device, authenticating the connection broker to a system service which is configured to run in the client computing device and which has access to the stored secret component of the user credentials, wherein the domain controller communicates with the client computing device and the connection broker and the domain controller performs Kerberos authentication in authenticating the connection broker to the system service; responsive to successful authentication of the connection broker to the system service, transmitting a second encrypted version of the secret component of the user credentials via the system service from the client computing device to the connection broker in a secure manner; in response to receiving the second encrypted version of the secret component by the connection broker: i) decrypting the second encrypted version of the secret component of the user credentials by the connection broker ii) re-encrypting the secret component of the user credentials by the connection broker to generate a third encrypted version of the secret component of the user credentials; and iii) forwarding the third encrypted version of the secret component of the user credentials from the connection broker to the service; and at the service, authenticating the user using the third encrypted version of the secret component of the user credentials forwarded by the connection broker. receiving an input of credentials of the user at a client computing device that communicates with the connection broker and with the service over a network, wherein the connection broker is configured to manage connections to a plurality of resources and the service is running in one of the resources, and wherein the user credentials include a secret component; securely storing the secret component in the client computing device; authenticating, using the user credentials, the user of the client computing device to grant access to the client computing device upon successful authentication, wherein the authentication of the user is performed by a domain controller; after the user has successfully accessed the client computing device, displaying a user interface on the client computing device and detecting an input from the user to access the service using the same user credentials which were used to access the client computing device; responsive to the user input at the client device, authenticating the connection broker to a system service which is configured to run in the client computing device and which has access to the stored secret component of the user credentials, wherein the domain controller communicates with the client computing device and the connection broker and the domain controller performs Kerberos authentication in authenticating the connection broker to the system service; responsive to successful authentication of the connection broker to the system service, transmitting a second encrypted version of the secret component of the user credentials via the system service from the client computing device to the connection broker in a secure manner; in response to receiving the second encrypted version of the secret component by the connection broker: i) decrypting the second encrypted version of the secret component of the user credentials by the connection broker ii) re-encrypting the secret component of the user credentials by the connection broker to generate a third encrypted version of the secret component of the user credentials; and iii) forwarding the third encrypted version of the secret component of the user credentials from the connection broker to the service; and i) decrypting the second encrypted version of the secret component of the user credentials by the connection broker ii) re-encrypting the secret component of the user credentials by the connection broker to generate a third encrypted version of the secret component of the user credentials; and iii) forwarding the third encrypted version of the secret component of the user credentials from the connection broker to the service; and at the service, authenticating the user using the third encrypted version of the secret component of the user credentials forwarded by the connection broker.