Authentication when using Gateway

Hi,

I have developed a Gateway odata service which is going to be used in an iPhone App for invoice approval.

But what is best practice about the user authentication? How should the user who is trying to logon be checked for the right password and for date validity etc?

Setup is a Gateway server and a backend so actually errors about the user could be triggered in both systems.

Any ideas?

Thanks,

Claus.