You could use MySQL to keep a user database. Then compare the name of the directory they are trying to access to their username... if they match, list out the contents of the directory, and if they don't match, echo out something like "You don't have access to these files".
I'm sure there's other ways to do it, but there's one.