title: Secure RESTful web service using Symfony2
body: <p>We are in the process of planning an iOS application in which users will need to be <em>authenticated</em> and <em>authorized</em> before they can interact with data provided by a Symfony2 web service.</p>
  
  <p>Authorization will be implemented with ACLs, it's the authentication I'm not sure about.</p>
  
  <p>From what I found in my research, there are a few ways to achieve the authentication part, but since there won't be any third parties accessing the data it sounds like basic HTTP authentication paired with a SSL certificate is the way to go. <strong>Is this correct?</strong></p>
  
  <p>Additionally, <strong>is a simple username and password secure enough, or is it better to add some sort of API key for identification?</strong></p>
  
  <p>If a key is needed and considering our users will be part of a group, <strong>should a key be bound to every user individually or to the group as a whole?</strong></p>
  
  <p>Finally, and slightly off topic, Symfony2 has <a href="https://github.com/FriendsOfSymfony/FOSRestBundle" rel="nofollow">FOSRestBundle</a>, <strong>is there a defacto REST library for iOS?</strong></p>