Each user at MIT has an MIT signed X.509 certificate. We connect to the servers using SSL and use client side certificates. The Apache modules are written to understand the MIT naming conventions used within the MIT certificates and are able to map these to our default Kerberos namespace. We use a modified .htaccess file. These are stored in AFS, within the same directory that contains the files to be restricted.
End users are able to create and modify their own access control files.
Details can be found at 6. The htaccess files may contain lists of MIT groups instead of individual users, in this case the groups would be expanded to individual users and then the name matching would be performed. I don't have access to the locally developed Apache modules at this time. Tom Coppeto does have access and should know where they are located.