Ok, so you can use a group strategy for each service. However, it's difficult to apply individual groups to projects within each service without customizations for each. For example, you can define separate groups for each service, SSH, Build Machine, SVN, etc.. For example, if you want users only in the source-control group to have access to SVN, you would specifiy the following URL in the cooresponding Apache virtual host:
<AuthnProviderAlias ldap ldap-users>
AuthLDAPUrl "ldaps://myldapserver:636/DC=mydomain,DC=local?sAMAccountName?sub?(&(objectCategory=person)(memberOf=CN=source-control,CN=Users,DC=mydomain,DC=local))" "SSL"
However, you will have to drill down to the service level using their known management. Take SVN for example:
[groups]
project1_team = dave, john, andy
[/]
* =
dave = rw
[/project1]
@project1_team = rw
[/project2]
andy = r
From: https://stackoverflow.com/questions/562755/how-do-i-prevent-a-subversion-user-accessing-part-of-the-repository