Apache Guide: Apache Authentication, Part 1 Page 2
The directives above only let one person (specifically someone with a
rbowen) into the directory. In most cases, you'll want
to let more than one person in. This is where the
comes in. In the example above, we've pointed
/dev/null, which is Unix-speak for "nowhere" or
"off into space." (The Windows NT equivalent of this is
If you want to let more than one person in, you'll need to create a group file that associates group names with a list of users in that group. The format of this file is pretty simple, and you can create it with your favorite editor. The contents of the file will look like this:
GroupName: rbowen dpitts sungo rshersey
That's just a list of the members of the group in a long line separated by spaces.
To add a user to your already existing password file, type:htpasswd /usr/local/apache/passwd/password dpitts
You'll get the same response as before, but it will be appended to the existing file, rather than creating a new file. (It's the
-cthat makes it create a new password file.)
Now, you need to modify your
.htaccessfile to look like the following:AuthType Basic AuthName "By Invitation Only" AuthUserFile /usr/local/apache/passwd/passwords AuthGroupFile /usr/local/apache/passwd/groups require group GroupName
Now, anyone that is listed in the group
GroupNameand has an entry in the
passwordfile, will be let in if they type the correct password.
There's another way to let multiple users in that is less specific. Rather than creating a group file, you can just use the following directive:require valid-user
Using that rather than the
require user rbowenline will allow anyone in that is listed in the password file and who correctly enters their password. You can even emulate the group behavior here by keeping a separate password file for each group. The advantage of this approach is that Apache only has to check one file, rather than two. The disadvantage is that you have to maintain a bunch of password files, and remember to reference the right one in the
Because of the way that basic authentication is specified, your username and password must be verified every time you request a document from the server. This is even if you're reloading the same page, and for every image on the page (if they come from a protected directory). As you can imagine, this slows things down a little. The amount that it slows things down is proportional to the size of the password file, because Apache must open up that file and go down the list of users until it gets to your name. And it has to do this every time a page is loaded.
A consequence of this is that there's a limit to how many users you can put in one password file. I don't exactly know what that limit is, but I've experienced problems when I've put more than about 1,500 users in one file. People are denied access, even though you know that they have a valid username and password. It appears that what's happening is that it just takes too long to look up the password, and in the meantime, access is denied.
In the next article, we'll look at one possible solution to this problem.
This may seem a little random, but it looked like a good time to throw this in.