Static site security question and help

Vital statistics:
     OS/400  - V4R5M0
     WAS Advanced Server - V3R0M2
     My "Weby" experience - Very limited

We are hosting a static website for use by employees.  The site is working
today.  The user ID and password stuff is working great.  We are using
validation lists and groups (no AS/400 user profiles).  We now need to add
a second "sub site".  People need specific access granted for each sub site
and a person can be granted access to both sub sites (the number of sub
sites will likely grow).

The folder structure looks kind of like this:

www
     morgsixsig
          SubSite1Folder1
          SubSite1Folder2
          SubSite1Folder...
     morgan_hr
          SubSite2Folder1
          SubSite2Folder2
          SubSite2Folder...

My Config file looks like this:

# HTTP CONFIGURATION FILE
Protection MORGSIXSIG {
      PasswdFile xxxxxx/xxxxxx
      ACLOverride Off
      Mask All@*
      AuthType Basic
      ServerID MorganSixSigma
      UserID %%SERVER%%
}
Protect /* MORGSIXSIG

I have not been able to get access control list protection to work
properly.  If I place a group file and add users to it then setup the
access control list to point to this group file, nothing happens. If I
setup the access control list to only point to a user ID, it works great.

Am I going about this the correct way?  If not how do others handle this
type of thing?

Thanks in advance,

Dwight Slessman