There are a ton of group management solutions out there, but the first to come to mind is LDAP. Then let someone else admin who is in what groups and what roles those groups have.