Client authenticates himself. Server checks authentication and authorization. If previous was step successful, document is sent normally by the server. Document is recieved normally by the client. A discussion of the basic protection scheme follows this information.
Client can thus figure out which password to use at any given time.
If scheme name is correct the authorization string is decoded. Otherwise, username and password are checked for validity from the password file. If there is no mask-group nor ACL, or if ACL exists, but there is no entry for that file, access is denied with a Frobidden 403 status code. If not, an Unauthorized 401 status etc. is sent. Otherwise, the server checks if the requested file exists.