I am looking for an enterprise user management system that meets these requirements:

• Delegated user administration: The group manager should be able to grant access to his supervised employees (without having to contact any administrator either to grant access or maybe create users).
• A group manager should be able to create other groups and restrict any permission he already has where he can add supervised employees.
• If a manager removes access to a supervised group, then all the subgroups will also lose access.
• Web based User Interface.
• LDAP interface to query users and groups (or may not exist at all if it is integrated in a single application).

Do you know if there are any system that meet these requirements?