diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAcl.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAcl.xml
index 886d9f206..f56065c94 100644
--- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAcl.xml
+++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAcl.xml
@@ -467,6 +467,23 @@
         <type>text</type>
         <help><![CDATA[The value of the Server Name TLS extension sent by a client ends with the specified string (suffix match).]]></help>
     </field>
+    <field>
+        <label>Parameters</label>
+        <type>header</type>
+        <style>expression_table table_http_auth</style>
+    </field>
+    <field>
+        <id>acl.allowedUsers</id>
+        <label>Allowed Users</label>
+        <type>select_multiple</type>
+        <allownew>true</allownew>
+    </field>
+    <field>
+        <id>acl.allowedGroups</id>
+        <label>Allowed Groups</label>
+        <type>select_multiple</type>
+        <allownew>true</allownew>
+    </field>
     <field>
         <label>Parameters</label>
         <type>header</type>
diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
index 66b025dfe..6b135564a 100644
--- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
+++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
@@ -1246,6 +1246,7 @@
                 <expression type="OptionField">
                     <Required>Y</Required>
                     <OptionValues>
+                        <http_auth>HTTP Basic Auth: username/password from client matches selected User/Group</http_auth>
                         <hdr_beg>Host starts with</hdr_beg>
                         <hdr_end>Host ends with</hdr_end>
                         <hdr>Host matches</hdr>
@@ -1631,6 +1632,30 @@
                     <Required>N</Required>
                     <Required>N</Required>
                 </queryBackend>
+                <allowedUsers type="ModelRelationField">
+                    <Model>
+                        <template>
+                            <source>OPNsense.HAProxy.HAProxy</source>
+                            <items>users.user</items>
+                            <display>name</display>
+                        </template>
+                    </Model>
+                    <ValidationMessage>Related user not found</ValidationMessage>
+                    <multiple>Y</multiple>
+                    <Required>N</Required>
+                </allowedUsers>
+                <allowedGroups type="ModelRelationField">
+                    <Model>
+                        <template>
+                            <source>OPNsense.HAProxy.HAProxy</source>
+                            <items>groups.group</items>
+                            <display>name</display>
+                        </template>
+                    </Model>
+                    <ValidationMessage>Related group not found</ValidationMessage>
+                    <multiple>Y</multiple>
+                    <Required>N</Required>
+                </allowedGroups>
             </acl>
         </acls>
         <actions>
diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
index a1bcbbaba..398e9561b 100644
--- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
+++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
@@ -72,7 +72,14 @@
 {%             endif %}
 {%             do acls_seen.append(acl_data.id) %}
 {%             set acl_options = [] %}
-{%             if acl_data.expression == 'hdr_beg' %}
+{%             if acl_data.expression == 'http_auth' %}
+{%               if acl_data.allowedUsers|default("") != "" or acl_data.allowedGroups|default("") != "" %}
+{%                 do acl_options.append('http_auth(acl_' ~ acl_data.id ~ ')') %}
+{%               else %}
+{%                 set acl_enabled = '0' %}
+    # ERROR: missing parameters
+{%               endif %}
+{%             elif acl_data.expression == 'hdr_beg' %}
 {%               if acl_data.hdr_beg|default("") != "" %}
 {%                 do acl_options.append('hdr_beg(host) -i ' ~ acl_data.hdr_beg) %}
 {%               else %}
@@ -678,7 +685,7 @@
 {%       endif %}
 {%     endfor %}
 {%   else %}
-# ERROR: UserlistAddUsers called with empty user data
+    # WARNING: UserlistAddUsers called with empty user data
 {%   endif %}
 {#   # process all group members #}
 {%   if linkedGroupData is defined %}
@@ -686,7 +693,7 @@
 {%       set group_data = helpers.getUUID(group) %}
 {#       # check if this group can (still) be found in configuration #}
 {%       if group_data == {} %}
-# ERROR: group data not found ({{group}})
+    # WARNING: group data not found ({{group}})
 {%       else %}
 {#         # extract user list from group object #}
 {%         for user in group_data.members.split(",") %}
@@ -707,7 +714,7 @@
 {%       endif %}
 {%     endfor %}
 {%   else %}
-# ERROR: UserlistAddUsers called with empty group data
+    # WARNING: UserlistAddUsers called with empty group data
 {%   endif %}
 {%- endmacro %}
 
@@ -857,38 +864,18 @@ defaults
 {# # NOTE: Yes, this config block is redundant and duplicates entries (on purpose). #}
 {# #       This makes it much easier for a user to compose this from the GUI. #}
 
-# autogenerated entries for all users/groups (may be used in ACLs)
-{# # add an entry for every user #}
-{% if helpers.exists('OPNsense.HAProxy.users') %}
-{%   for user_data in helpers.toList('OPNsense.HAProxy.users.user') %}
-{%     if user_data.enabled|default("") == '1' %}
-userlist user_{{user_data.id}}
-{#       # check if using an encrypted password #}
-{%       if user_data.password|default("")|truncate(1, False, '', 0) == '$' %}
-{%         set user_pwsec = 'password' %}
-{%       else %}
-{%         set user_pwsec = 'insecure-password' %}
+# autogenerated entries for ACLs
+{% if helpers.exists('OPNsense.HAProxy.acls') %}
+{%   for acl in helpers.toList('OPNsense.HAProxy.acls.acl') %}
+{%     if (acl.allowedUsers|default("") != "") or (acl.allowedGroups|default("") != "") %}
+{#       # call macro to generate list of unique users #}
+{%       set userlist_result = UserlistAddUsers(acl.allowedUsers, acl.allowedGroups) %}
+{#       # check result, skip when empty #}
+{%       if (userlist_result is defined and userlist_result|default("") != "" )%}
+userlist acl_{{acl.id}}
+    # Origin: {{acl.name}}
+{{userlist_result}}
 {%       endif %}
-    user {{user_data.name}} {{user_pwsec}} {{user_data.password}}
-{%     endif %}
-{%   endfor %}
-{% endif %}
-{# # add an entry for every group #}
-{% if helpers.exists('OPNsense.HAProxy.groups') %}
-{%   for group_data in helpers.toList('OPNsense.HAProxy.groups.group') %}
-{%     if group_data.enabled|default("") == '1' %}
-userlist group_{{group_data.id}}
-{#       # extract user list from group object #}
-{%       for user in group_data.members.split(",") %}
-{%         set user_data = helpers.getUUID(user) %}
-{#         # check if using an encrypted password #}
-{%         if user_data.password|default("")|truncate(1, False, '', 0) == '$' %}
-{%           set user_pwsec = 'password' %}
-{%         else %}
-{%           set user_pwsec = 'insecure-password' %}
-{%         endif %}
-    user {{user_data.name}} {{user_pwsec}} {{user_data.password}}
-{%       endfor %}
 {%     endif %}
 {%   endfor %}
 {% endif %}