Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am looking for an enterprise user management system that meets these requirements:

  • Delegated user administration: The group manager should be able to grant access to his supervised employees (without having to contact any administrator either to grant access or maybe create users).
  • A group manager should be able to create other groups and restrict any permission he already has where he can add supervised employees.
  • If a manager removes access to a supervised group, then all the subgroups will also lose access.
  • Web based User Interface.
  • LDAP interface to query users and groups (or may not exist at all if it is integrated in a single application).

Do you know if there are any system that meet these requirements?


migration rejected from stackoverflow.com Feb 21 at 3:34

This question came from our site for professional and enthusiast programmers. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.

closed as off-topic by Bryan, Katherine Villyard, Michael Hampton Feb 21 at 3:34

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – Bryan, Katherine Villyard, Michael Hampton
If this question can be reworded to fit the rules in the help center, please edit the question.

Is this a programming question? Are you looking for an API library that does this? If so, what platform does it need to be on (.NET, Java, C++, Objective-C)? –  Aaronaught Feb 28 '10 at 18:42
Some idea of which OS(s) you would like this to work on would be handy. As it stand the question cannot be expected to get anything more than a conceptual answer. –  John Gardeniers Feb 28 '10 at 21:50
@Aaronaught I am just looking for an implementation. I am programming in JavaEE but the interface may be LDAP to be able to work from different programming languages. –  Eduardo Mar 1 '10 at 20:47
@John Gardeniers It should be totally OS independent. –  Eduardo Mar 1 '10 at 20:47

5 Answers 5

Active Directory has all the functionality you requested above built in to its management tools. Novell also has a centralized directory/authorization program called eDirectory

Well, except for the web-front-end part. While one could be built, it isn't out-of-the-box. And he doesn't explain what he's granting access to - whether it's SharePoint, or Exchange mailboxes, or NTFS files. That part would have to be built into the web app as well, those aren't defined in AD, they only use AD. –  mfinni Mar 1 '10 at 4:17
@mfinni The applications that will use the system just define some roles and the system should just tell me if the user has the role or not –  Eduardo Mar 1 '10 at 20:49

I'm working in an environment where there is a system installed with similar funcionality as the one you describe. I don't know if it fullfills all of your requirements, but it might be worth having a look at it: http://www.nordicedge.se/


We use Computer Associates Identity Lifecycle Management product. It works well, but does require a large investment to install and maintain.


You are looking for Identity Manager (formerly by Novell, now transferred to NetIQ but still part of the same corporate structure). It allows all of those rules you are looking for, and will attach to the Directory Service of your choice (eDirectory or Active Directory). And yes, it has a web-based User Application to do much of the above.



You can have a look at ADManager. But instead of groups, it allows to manage users with delegated access.


Not the answer you're looking for? Browse other questions tagged or ask your own question.