Apache Guide: Apache Authentication, Part 1 Page 2

The directives above only let one person (specifically someone with a username of rbowen) into the directory. In most cases, you'll want to let more than one person in. This is where the AuthGroupFile comes in. In the example above, we've pointed AuthGroupFile to /dev/null, which is Unix-speak for "nowhere" or "off into space." (The Windows NT equivalent of this is nul.)

If you want to let more than one person in, you'll need to create a group file that associates group names with a list of users in that group. The format of this file is pretty simple, and you can create it with your favorite editor. The contents of the file will look like this:

       GroupName: rbowen dpitts sungo rshersey



That's just a list of the members of the group in a long line separated by
spaces.


To add a user to your already existing password file, type:
       htpasswd /usr/local/apache/passwd/password dpitts



You'll get the same response as before, but it will be appended to the
existing file, rather than creating a new file. (It's the -c that
makes it create a new password file.)


Now, you need to modify your .htaccess file to look like the
following:
        AuthType Basic
        AuthName "By Invitation Only"
        AuthUserFile /usr/local/apache/passwd/passwords
        AuthGroupFile /usr/local/apache/passwd/groups
        require group GroupName



Now, anyone that is listed in the group GroupName and has an
entry in the password file, will be let in if they type the
correct password.


There's another way to let multiple users in that is less specific. Rather
than creating a group file, you can just use the following directive:
       require valid-user



Using that rather than the require user rbowen line will allow
anyone in that is listed in the password file and who correctly enters their
password. You can even emulate the group behavior here by keeping a separate
password file for each group. The advantage of this approach is that Apache
only has to check one file, rather than two. The disadvantage is that you have
to maintain a bunch of password files, and remember to reference the right one
in the AuthUserFile directive. 
Possible Problems


Because of the way that basic authentication is specified, your username and
password must be verified every time you request a document from the server.
This is even if you're reloading the same page, and for every image on the page
(if they come from a protected directory). As you can imagine, this slows
things down a little. The amount that it slows things down is proportional to
the size of the password file, because Apache must open up that file and go
down the list of users until it gets to your name. And it has to do this every
time a page is loaded.


A consequence of this is that there's a limit to how many users you can put
in one password file. I don't exactly know what that limit is, but I've
experienced problems when I've put more than about 1,500 users in one file.
People are denied access, even though you know that they have a valid
username and password. It appears that what's happening is that it just takes
too long to look up the password, and in the meantime, access is denied.


In the next article, we'll look at one possible solution to this problem. 

Managing Your Password
Files with Perl


This may seem a little random, but it looked like a good time to throw this
in.