Method for operating a backend session manager at a backend and a service gateway session manager for authenticating a hybrid service accessible by a client (102, 302), • wherein, of at least two service components of said hybrid service, at least one service component is provided by a smart subsystem (ssub) being a service gateway and is managed by the service gateway session manager and at least one other service component is provided by a different subsystem; the method comprising: • providing authentication information of the client (102, 302) to the backend session manager; • wherein upon login of said client (102, 302) at the backend, said backend session manager generates a backend-session ID and a backend-service-session ID for the hybrid service wherein the backend-service-session ID is provided to the different subsystem and to the client wherein the backend session manager further gets an IP address of said client (102, 302) to generate a key pass which is provided to the smart subsystem (ssub), • wherein said smart subsystem (ssub) performs session management for services that run on it, • wherein said smart subsystem (ssub) upon reception of said key pass opens a port for said client IP address in its firewall to allow said client (102, 302) to access said smart subsystem (ssub), • wherein after said login at said backend said client (102, 302) establishes another login to said smart subsystem (ssub), • wherein the service gateway session manager will then create a SSub-session ID used to authenticate client calls to the smart subsystem (ssub) and a client-related service-session ID for the at least one service component; and will then provide the generated client-related service-session ID to the client (102, 302), • wherein, upon reception of a request of the client for the hybrid service, the hybrid service is authenticated by either said backend in case the request comprises the backend-service-session ID or said smart subsystem (ssub) in case the request comprises the client-related service-session ID. • wherein, of at least two service components of said hybrid service, at least one service component is provided by a smart subsystem (ssub) being a service gateway and is managed by the service gateway session manager and at least one other service component is provided by a different subsystem; the method comprising: • providing authentication information of the client (102, 302) to the backend session manager; • wherein upon login of said client (102, 302) at the backend, said backend session manager generates a backend-session ID and a backend-service-session ID for the hybrid service wherein the backend-service-session ID is provided to the different subsystem and to the client wherein the backend session manager further gets an IP address of said client (102, 302) to generate a key pass which is provided to the smart subsystem (ssub), • wherein said smart subsystem (ssub) performs session management for services that run on it, • wherein said smart subsystem (ssub) upon reception of said key pass opens a port for said client IP address in its firewall to allow said client (102, 302) to access said smart subsystem (ssub), • wherein after said login at said backend said client (102, 302) establishes another login to said smart subsystem (ssub), • wherein the service gateway session manager will then create a SSub-session ID used to authenticate client calls to the smart subsystem (ssub) and a client-related service-session ID for the at least one service component; and will then provide the generated client-related service-session ID to the client (102, 302), • wherein, upon reception of a request of the client for the hybrid service, the hybrid service is authenticated by either said backend in case the request comprises the backend-service-session ID or said smart subsystem (ssub) in case the request comprises the client-related service-session ID.