I have a question about how something works low level in User

If you assign a Role with an endate, it is RRSD I think that is
responsible for finding it, and removing it on the appropriate date.

How does it do this?

I caught an example in trace, and I see a single line in trace. The
question I was wondering is, does it use the IDM provided Query function
(which cannot do timestamp valued queries, you know like
(nrfRequestEndDate<201307221234) which the Work Order driver does) which
means, read back all objects of target class, with the EndDate
attribute, and then check the date value and only keep those that are

Or does it implement LDAP to make an LDAP query that CAN do a timestamp
value query and only return relevant ones?

If the former, it is an easy fix to add a package to change it. If the
later, then so be it. From a performance approach, the LDAP query is
way more efficient.