The directives above only let one person (specifically someone with a
rbowen) into the directory. In most cases, you’ll want
to let more than one person in. This is where the
comes in. In the example above, we’ve pointed
/dev/null, which is Unix-speak for “nowhere” or
“off into space.” (The Windows NT equivalent of this is
If you want to let more than one person in, you’ll need to create a group
file that associates group names with a list of users in that group. The format
of this file is pretty simple, and you can create it with your favorite editor.
The contents of the file will look like this:
GroupName: rbowen dpitts sungo rshersey
That's just a list of the members of the group in a long line separated by
To add a user to your already existing password file, type:htpasswd /usr/local/apache/passwd/password dpitts
You'll get the same response as before, but it will be appended to the
existing file, rather than creating a new file. (It's the
makes it create a new password file.)
Now, you need to modify your
.htaccessfile to look like the
following:AuthType Basic AuthName "By Invitation Only" AuthUserFile /usr/local/apache/passwd/passwords AuthGroupFile /usr/local/apache/passwd/groups require group GroupName
Now, anyone that is listed in the group
GroupNameand has an
entry in the
passwordfile, will be let in if they type the
There's another way to let multiple users in that is less specific. Rather
than creating a group file, you can just use the following directive:require valid-user
Using that rather than the
require user rbowenline will allow
anyone in that is listed in the password file and who correctly enters their
password. You can even emulate the group behavior here by keeping a separate
password file for each group. The advantage of this approach is that Apache
only has to check one file, rather than two. The disadvantage is that you have
to maintain a bunch of password files, and remember to reference the right one
Because of the way that basic authentication is specified, your username and
password must be verified every time you request a document from the server.
This is even if you're reloading the same page, and for every image on the page
(if they come from a protected directory). As you can imagine, this slows
things down a little. The amount that it slows things down is proportional to
the size of the password file, because Apache must open up that file and go
down the list of users until it gets to your name. And it has to do this every
time a page is loaded.
A consequence of this is that there's a limit to how many users you can put
in one password file. I don't exactly know what that limit is, but I've
experienced problems when I've put more than about 1,500 users in one file.
People are denied access, even though you know that they have a valid
username and password. It appears that what's happening is that it just takes
too long to look up the password, and in the meantime, access is denied.
In the next article, we'll look at one possible solution to this problem.
This may seem a little random, but it looked like a good time to throw this