Internal Database vs LDAP for Credential Expiration Management

Implementing a least-privilege security model in RabbitMQ requires a strategy for handling credential lifecycles and password expiration. The internal database allows for granular Virtual Host (vhost) permissions but lacks native, automated timers to expire user credentials.

Alternatively, the rabbitmq_auth_backend_ldap plugin delegates authentication to a centralized identity provider, enabling the enforcement of corporate password expiration policies and automated account lockouts without manual intervention in the RabbitMQ CLI.

The decision involves balancing the low latency of local authentication against the administrative overhead of managing credential rotation across multiple nodes.

• Does the internal database support any native mechanism for time-based credential expiration in recent versions?
• What is the performance impact on authorization when delegating credential validation to an external LDAP provider compared to the local database?