Removing the responsbility of user maintenance from the DBA

Question

Suppose you were working with a customer whose DBAs refuse to be involved with user maintenance, i.e. creation and deletion of users, password maintenance, role and privilege assignment etc. What technology and/or approach would you recommend?
Some random thoughts along this line:
1. Ask the DBA to create one user with CREATE USER and ALTER USER privileges, and give that user access to SQL*Plus so that he can run the queries to create and maintain users himself. Obvious downside: Someone else has to know SQL, at least a few SQL statements, or have a custom user interface built for them that wraps the SQL statements. Is this really such a bad solution?
2. LDAP or OID. I don't understand enough about either of these two technologies to truly be able to discuss the pros and cons. How exactly do they work in a Windows network envionment, perhaps one with or without Active Directory and/or Windows Groups? Can they really allow someone other than the DBA to create users, maintain passwords and maintain roles and privileges? If so, doesn't the person in charge of assigning roles and privileges to users have to have CREATE USER or ALTER USER privileges anyway? Really, why would this be such an improvement over solution #1?
3. Any other approaches and/or experiences along this lines anyone wouldn't mind sharing?
Appreciating any and all insights,
DTXCF

Answer 1

THanks sybrandb.
On #2, suppose the application is set up in such a way that by default all of the security is handled in the database, i.e. when the application is installed and the scripts run to create the database it creates roles like these:
cst_role_product_editor
cst_role_product_admin
cst_role_product_viewer
cst_role_order_viewer
cst_role_order_admin
cst_role_order_editor
cst_role_store_viewer
cst_role_store_editor
cst_role_store_admin
in other words, for each object type in the database (stores, products, orders, coupons, catalogs etc.) all of these roles are created at the database level, and by default, each individual user has to be created using a CREATE USER command with the proper roles assigned.
If I take an application like this to the client and they say they want to implement LDAP and/or OID, when the people who create these users outside the database as you mention,
1) Does it create any additional actual Oracle users, and
2) Can LDAP and OID handle actually assigning these users to specific Oracle roles?
And one more question - can you explain what exactly is a proxy account to a rookie like me who thinks proxy sounds like the name of a night club you'd find in Las Vegas?
Sorry to impose so much but I do appreciate the help.