Setting a password on Apache – where to put AllowOverride AuthConfig

I want to password-protect a website using Apache. (Beginner alert.) From another question on serverfault, I've found these instructions, which are really helpful.

But I've immediately hit problems at Step 1 – adding AllowOverride AuthConfig. My httpd.conf file doesn't look anything like the example given, it's only got one line:

ExtendedStatus On

In the same directory, there's an apache2.conf file which has lots more content, but nothing that looks like a DocumentRoot entry.

Finally, my Apache setup is using a bunch of virtual hosts, and in the sites-available directory, there's a file for my site that looks like this:

<VirtualHost *:80>
    ServerName blah
    WSGIScriptAlias / /home/okfn/var/srvc/blah/pyenv/bin/blah.py
    WSGIPassAuthorization On
    ErrorLog /var/log/apache2/blah.error.log
    CustomLog /var/log/apache2/blah.custom.log combined
</VirtualHost>

Given all of the above, where do I put AllowOverride AuthConfig?