A computer-implemented method comprising: - receiving, by a first gateway, a first connection request from a user device, said first connection request comprising an access token; - validating the access token in an identity and access management, IAM, service; - after successful validation, establishing a first tunnel between the user device and a target device (141, 141') via a chain of trusted certificate-based point-to-point connections through one or more intermediate gateways (120, 130', 140), wherein the first tunnel is established by using a reverse connection from the first gateway to the target device (141, 141'), said reverse connection being based on a pre-established connection from the target device (141, 141') to the first gateway via an outbound port in the target device (141, 141') and in each of the one or more intermediate gateways (120, 130', 140) in the chain, said target device (141, 141') having no direct internet protocol connectivity to the user device without the first tunnel; - receiving, by the target device (141, 141'), a second connection request from the user device via the first tunnel, said second connection request comprising the access token; - establishing a second tunnel between the target device (141, 141') and the IAM service via the chain of trusted certificate-based point-to-point connections through the one or more intermediate gateways (120, 130', 140), wherein the second tunnel is established by using the reverse connection from the first gateway to the target device (141, 141'), said target device (141, 141') having no direct internet protocol connectivity to the IAM service without the second tunnel; - validating the access token in the IAM service via the second tunnel. - receiving, by a first gateway, a first connection request from a user device, said first connection request comprising an access token; - validating the access token in an identity and access management, IAM, service; - after successful validation, establishing a first tunnel between the user device and a target device (141, 141') via a chain of trusted certificate-based point-to-point connections through one or more intermediate gateways (120, 130', 140), wherein the first tunnel is established by using a reverse connection from the first gateway to the target device (141, 141'), said reverse connection being based on a pre-established connection from the target device (141, 141') to the first gateway via an outbound port in the target device (141, 141') and in each of the one or more intermediate gateways (120, 130', 140) in the chain, said target device (141, 141') having no direct internet protocol connectivity to the user device without the first tunnel; - receiving, by the target device (141, 141'), a second connection request from the user device via the first tunnel, said second connection request comprising the access token; - establishing a second tunnel between the target device (141, 141') and the IAM service via the chain of trusted certificate-based point-to-point connections through the one or more intermediate gateways (120, 130', 140), wherein the second tunnel is established by using the reverse connection from the first gateway to the target device (141, 141'), said target device (141, 141') having no direct internet protocol connectivity to the IAM service without the second tunnel; - validating the access token in the IAM service via the second tunnel.