Password management at an organization [closed]

Question

In my company we have a largish number of secure logins, currently all stored in a single KeePass database which some of us share the keys to. We'd like to have a more fine-grained, identity-based system where particular users can be given access to particular identities and that access can be later revoked as needed.

The infrastructure to do this doesn't seem terrifically difficult to build, but it does seem terrifically difficult to build in a trustworthy way and also like something somebody else has done really well.

So, what's a great way to manage a large number of encrypted, secure bits of information using a series of identities. Versioning and backup are also critical components in that we ought to be able to share the entire system in something like Dropbox without clobbering each other's changes.

Answer 1

One answer we've investigated a little bit is Gazzang's zTrustee system. It's a hosted password management system that allows secure blobs to be owned by a set of "trustees" who set policies on who is allowed to access or change the blobs. Trustees can set blanket policies, review policies for particular accessing identities, or even review pending requests and approve them on an individual basis.

The level of control offered is great as is the API access, but less satisfied by depending on a third party or spending a great deal for this software. I also trust them less due to their marketing.