Implement blacklist/whitelist + LDAP authentication in Apache

Here's how I manage the repository access:

1. Every repository has an "admin" directory, which contains the authz file
2. I set up the authz file to limit access to the "admin" directory to the "owners" of the repository.
3. I have a cron job check for changes in the "admin" directory, and copy out the authz file into the repository.

I don't do anything in the Apache config other that "require valid-user" (that way Apache only needs to be restarted when new repositories get added).

This way I offload all the maintenance of repository permissions to the owners of the repository. This may not directly address your problem, as it doesn't incorporate any LDAP groups, but this solution has worked for me for several years with hundreds of repositories.

Scott's answer put me on the right path. Originally I had some authentication directives duplicated in different files, one for the main site, and others in gitweb and websvn specific configurations. I removed the authentication bits from the gitweb and websvn configs, and moved all the authentication stuff to the main site file in .../apache2/sites-available/example:

<VirtualHost *:8080>
  DocumentRoot  /var/www
  ServerName    example.com

  <Location />
    AuthName "example"
        AuthType Basic
        AuthBasicProvider ldap
        AuthLDAPURL ldap://example.com/dc=example,dc=com?uid?sub
        AuthLDAPBindDN "cn=admin,dc=example,dc=com
        Include ldap_password.conf

        Require valid-user
  </Location>

  <Location /gitweb>
    Require ldap-group cn=git,ou=group,dc=example,dc=com
  </Location>

  <Location /websvn>
    Require ldap-group cn=subversion,ou=group,dc=example,dc=com
  </Location>
</VirtualHost>

Now with this setup a user is prompted for login when accessing the main site, and if they are in the correct development group, they can access the repos. If not, they are again prompted for another login.