Does anyone know which of the big players (if any) support LDAP/AD users and groups for authentication AND database permissions? Specifically, I'm wondering if SVN, GIT, Mercurial etc. will allow users to login/connect based on AD permissions and also allow granular permissions to be applied to folders within the VC database based on groups within AD. So far my research has not shown this to be possible....
VisualSVN Server allows you to manage svn repository permissions using AD users and groups. And the standard edition is free and meets most organization's needs.
Not to be flippant, but really, just about all of them do. Since PAM on Linux supports LDAP, standard unix accounts (and therefore, standard files) support LDAP, almost all Linux-compatible version control systems should work fine. Likewise, Windows supports LDAP through Active Directory (AD is basically LDAP with kerberos and some deployment tools, as I understand it), and so any version control that works with standard windows accounts should support it too. I'm pretty sure this all applies to OS X as well.
Git certainly does - you need to set up PAM to use pam_winbind.so and pam_mkhomedir.so. Create a group (either locally or in AD, depending on how you want to do it) and create your git repositories on the origin server with the --shared flag. This will tell git that you are sharing the repository amongst multiple users, and it will set up permissions appropriately.
Regarding Subversion, there is a tool called svnperms, which can use LDAP to fetch group information (the ACLs are still in the configuration file, but it should be easy to adapt it).
I use Subversion Administrator it is a simple open source web app that allows for integration with active directory/ldap as well as managing post commit hook subscriptions
SourceGear Vault and Fortress supports authenticating the user via Active Directory.
Vault's Active Directory integration doesn't automatically pickup your current credentials. You enter your user/pwd, and it queries A.D. to authenticate those credentials that you enter. This is a server-side configuration item, obviously, and the server must be configured to use A.D. identity impersonation.
Unfortunately the user list is still maintained within Vault itself. CRUDing users is still up to the version control admin.