1. A method, comprising: receiving an authentication challenge at a mobile device in connection with an authentication process for a managed application creating a virtual private network (VPN) tunnel specific to the managed application; analyzing policy information to determine that the policy information allows the mobile device to respond to the authentication challenge instead of a user or the managed application, wherein the policy information describes one or more policies for providing the managed application with access to at least one resource accessible through an access gateway; responding, by the mobile device, to the authentication challenge instead of the user or the managed application; and providing the managed application with access to the at least one resource based at least on the virtual private network (VPN) tunnel to the at least one resource, a ticket configured to provide authentication in connection with creating the VPN tunnel, and the policy information.