What is the best/simplest way to transmit the user credentials (Active Directory) over the transport layer.
I have two systems A and B connected with a 3rd party message layer C.
Is there any way (preferable in .NET) to somehow store/serialize the credentials of the authenticated user on the side A, transmit it over the C, then to de-serialize it on side B and then to make a call to the downstream system D using the de-serialized credentials?
That is called impersonation, but without any details on the underlying systems, I cannot really tell if that will be supported.
If the system is based on WCF, this is definitely possible. This MSDN page contains all the details.
To "mule" credentials to another system that can be authenticated by one of AD's authentication front-ends, you need either an impersonation-friendly protocol (such as Kerberos), the raw credentials themselves (sometimes referred to as "basic" or "username/password", but could also under certain circumstances be something like an RSA keypair) and optionally a framework in which to wrap those credentials (e.g. WS-Sec, SAML).
The access token generated by Windows' LSA is only valid on the system on which the token was generated - if you serialized and deserialized a token from one system to another, the LSA wouldn't accept it as proof that the process had been authenticated by that target system and had any right to access any secured resource on the system. Otherwise you'd be talking about a system subject to replay attacks (taking the security context from one box and replaying it - maliciously or otherwise, the security threat model wouldn't care - on another).
So the "easiest" way to do this is for your code to prompt the user to type in their username and password. This is also the scenario most subject to security flaws, and any right-minded organization would choke if their applications did something this crude, but it is a theoretical option.
Better would be to find a way for the inter-system communication to include embedded support for an authentication protocol - see GSS-API for one cross-platform API that is often serviceable in these contexts.