diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_db.erl b/deps/rabbitmq_management/src/rabbit_mgmt_db.erl
index 02b00cbdb3..41e23af6a3 100644
--- a/deps/rabbitmq_management/src/rabbit_mgmt_db.erl
+++ b/deps/rabbitmq_management/src/rabbit_mgmt_db.erl
@@ -241,7 +241,7 @@ handle_call({get_channel, Name}, _From, State = #state{tables = Tables}) ->
 
 handle_call({get_overview, Username}, _From, State = #state{tables = Tables}) ->
     VHosts = case Username of
-                 all -> rabbit_access_control:list_vhosts();
+                 all -> rabbit_vhost:list();
                  _   -> rabbit_mgmt_util:vhosts(Username)
              end,
     Qs0 = [rabbit_mgmt_format:queue(Q) || V <- VHosts,
diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_util.erl b/deps/rabbitmq_management/src/rabbit_mgmt_util.erl
index 1e7628cead..20e429f105 100644
--- a/deps/rabbitmq_management/src/rabbit_mgmt_util.erl
+++ b/deps/rabbitmq_management/src/rabbit_mgmt_util.erl
@@ -85,7 +85,7 @@ is_authorized(ReqData, Context, Fun) ->
 vhost(ReqData) ->
     case id(vhost, ReqData) of
         none  -> none;
-        VHost -> case rabbit_access_control:vhost_exists(VHost) of
+        VHost -> case rabbit_vhost:exists(VHost) of
                      true  -> VHost;
                      false -> not_found
                  end
@@ -275,8 +275,7 @@ amqp_request(VHost, ReqData, Context, Method) ->
 
 all_or_one_vhost(ReqData, Fun) ->
     case rabbit_mgmt_util:vhost(ReqData) of
-        none      -> lists:append(
-                       [Fun(V) || V <- rabbit_access_control:list_vhosts()]);
+        none      -> lists:append([Fun(V) || V <- rabbit_vhost:list()]);
         not_found -> vhost_not_found;
         VHost     -> Fun(VHost)
     end.
diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_wm_all_configuration.erl b/deps/rabbitmq_management/src/rabbit_mgmt_wm_all_configuration.erl
index eb4ac42bfe..41ece38b15 100644
--- a/deps/rabbitmq_management/src/rabbit_mgmt_wm_all_configuration.erl
+++ b/deps/rabbitmq_management/src/rabbit_mgmt_wm_all_configuration.erl
@@ -186,7 +186,7 @@ add_vhost(VHost) ->
     rabbit_mgmt_wm_vhost:put_vhost(VHostName).
 
 add_permission(Permission) ->
-    rabbit_access_control:set_permissions(pget(user,      Permission),
+    rabbit_auth_backend_internal:set_permissions(pget(user,      Permission),
                                           pget(vhost,     Permission),
                                           pget(configure, Permission),
                                           pget(write,     Permission),
diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_wm_permission.erl b/deps/rabbitmq_management/src/rabbit_mgmt_wm_permission.erl
index d3e32752b6..c9d47a472d 100644
--- a/deps/rabbitmq_management/src/rabbit_mgmt_wm_permission.erl
+++ b/deps/rabbitmq_management/src/rabbit_mgmt_wm_permission.erl
@@ -58,7 +58,7 @@ accept_content(ReqData, Context) ->
             rabbit_mgmt_util:with_decode(
               [configure, write, read], ReqData, Context,
               fun([Conf, Write, Read]) ->
-                      rabbit_access_control:set_permissions(
+                      rabbit_auth_backend_internal:set_permissions(
                         User, VHost, Conf, Write, Read),
                       {true, ReqData, Context}
               end)
@@ -67,7 +67,7 @@ accept_content(ReqData, Context) ->
 delete_resource(ReqData, Context) ->
     User = rabbit_mgmt_util:id(user, ReqData),
     VHost = rabbit_mgmt_util:id(vhost, ReqData),
-    rabbit_access_control:clear_permissions(User, VHost),
+    rabbit_auth_backend_internal:clear_permissions(User, VHost),
     {true, ReqData, Context}.
 
 is_authorized(ReqData, Context) ->
@@ -77,14 +77,15 @@ is_authorized(ReqData, Context) ->
 
 perms(ReqData) ->
     User = rabbit_mgmt_util:id(user, ReqData),
-    case rabbit_access_control:lookup_user(User) of
+    case rabbit_auth_backend_internal:lookup_user(User) of
         {ok, _} ->
             case rabbit_mgmt_util:vhost(ReqData) of
                 not_found ->
                     not_found;
                 VHost ->
-                    Perms = rabbit_access_control:list_user_vhost_permissions(
-                              User, VHost),
+                    Perms =
+                        rabbit_auth_backend_internal:list_user_vhost_permissions(
+                          User, VHost),
                     case Perms of
                         [{Configure, Write, Read}] ->
                             {User, VHost, Configure, Write, Read};
diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_wm_permissions.erl b/deps/rabbitmq_management/src/rabbit_mgmt_wm_permissions.erl
index cccc18f2e9..1f265ef7fd 100644
--- a/deps/rabbitmq_management/src/rabbit_mgmt_wm_permissions.erl
+++ b/deps/rabbitmq_management/src/rabbit_mgmt_wm_permissions.erl
@@ -39,4 +39,4 @@ is_authorized(ReqData, Context) ->
 
 permissions() ->
     [rabbit_mgmt_format:permissions(P) ||
-        P <- rabbit_access_control:list_permissions()].
+        P <- rabbit_auth_backend_internal:list_permissions()].
diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_wm_permissions_user.erl b/deps/rabbitmq_management/src/rabbit_mgmt_wm_permissions_user.erl
index f7b2ee1ab6..a360d3f16d 100644
--- a/deps/rabbitmq_management/src/rabbit_mgmt_wm_permissions_user.erl
+++ b/deps/rabbitmq_management/src/rabbit_mgmt_wm_permissions_user.erl
@@ -29,7 +29,7 @@ content_types_provided(ReqData, Context) ->
 
 to_json(ReqData, Context) ->
     User = rabbit_mgmt_util:id(user, ReqData),
-    Perms = rabbit_access_control:list_user_permissions(User),
+    Perms = rabbit_auth_backend_internal:list_user_permissions(User),
     rabbit_mgmt_util:reply_list(
       [rabbit_mgmt_format:permissions({User, VHost,
                                        Conf, Write, Read}) ||
diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_wm_permissions_vhost.erl b/deps/rabbitmq_management/src/rabbit_mgmt_wm_permissions_vhost.erl
index edb01d9b53..b55df7a58e 100644
--- a/deps/rabbitmq_management/src/rabbit_mgmt_wm_permissions_vhost.erl
+++ b/deps/rabbitmq_management/src/rabbit_mgmt_wm_permissions_vhost.erl
@@ -29,7 +29,7 @@ content_types_provided(ReqData, Context) ->
 
 to_json(ReqData, Context) ->
     VHost = rabbit_mgmt_util:id(vhost, ReqData),
-    Perms = rabbit_access_control:list_vhost_permissions(VHost),
+    Perms = rabbit_auth_backend_internal:list_vhost_permissions(VHost),
     rabbit_mgmt_util:reply_list(
       [rabbit_mgmt_format:permissions({User, VHost,
                                        Conf, Write, Read}) ||
diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_wm_user.erl b/deps/rabbitmq_management/src/rabbit_mgmt_wm_user.erl
index c7d5000370..1f46060068 100644
--- a/deps/rabbitmq_management/src/rabbit_mgmt_wm_user.erl
+++ b/deps/rabbitmq_management/src/rabbit_mgmt_wm_user.erl
@@ -57,7 +57,7 @@ accept_content(ReqData, Context) ->
 
 delete_resource(ReqData, Context) ->
     User = rabbit_mgmt_util:id(user, ReqData),
-    rabbit_access_control:delete_user(User),
+    rabbit_auth_backend_internal:delete_user(User),
     {true, ReqData, Context}.
 
 is_authorized(ReqData, Context) ->
@@ -66,35 +66,35 @@ is_authorized(ReqData, Context) ->
 %%--------------------------------------------------------------------
 
 user(ReqData) ->
-    rabbit_access_control:lookup_user(rabbit_mgmt_util:id(user, ReqData)).
+    rabbit_auth_backend_internal:lookup_user(rabbit_mgmt_util:id(user, ReqData)).
 
 put_user(User) ->
     case {proplists:is_defined(password, User),
           proplists:is_defined(password_hash, User)} of
         {true, _} ->
             Pass = proplists:get_value(password, User),
-            put_user(User, Pass, fun rabbit_access_control:change_password/2);
+            put_user(User, Pass, fun rabbit_auth_backend_internal:change_password/2);
         {_, true} ->
             Hash = base64:decode(proplists:get_value(password_hash, User)),
             put_user(User, Hash,
-                     fun rabbit_access_control:change_password_hash/2);
+                     fun rabbit_auth_backend_internal:change_password_hash/2);
         _ ->
             put_user(User, <<>>,
-                     fun rabbit_access_control:change_password_hash/2)
+                     fun rabbit_auth_backend_internal:change_password_hash/2)
     end.
 
 put_user(User, PWArg, PWFun) ->
     Username = proplists:get_value(name, User),
     IsAdmin = proplists:get_value(administrator, User),
-    case rabbit_access_control:lookup_user(Username) of
+    case rabbit_auth_backend_internal:lookup_user(Username) of
         {error, not_found} ->
-            rabbit_access_control:add_user(
+            rabbit_auth_backend_internal:add_user(
               Username, rabbit_guid:binstring_guid("tmp_"));
         _ ->
             ok
     end,
     PWFun(Username, PWArg),
     case rabbit_mgmt_util:parse_bool(IsAdmin) of
-        true  -> rabbit_access_control:set_admin(Username);
-        false -> rabbit_access_control:clear_admin(Username)
+        true  -> rabbit_auth_backend_internal:set_admin(Username);
+        false -> rabbit_auth_backend_internal:clear_admin(Username)
     end.
diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_wm_users.erl b/deps/rabbitmq_management/src/rabbit_mgmt_wm_users.erl
index 032f2fcd44..9f4c0e4f78 100644
--- a/deps/rabbitmq_management/src/rabbit_mgmt_wm_users.erl
+++ b/deps/rabbitmq_management/src/rabbit_mgmt_wm_users.erl
@@ -38,6 +38,6 @@ is_authorized(ReqData, Context) ->
 
 users() ->
     [begin
-         {ok, User} = rabbit_access_control:lookup_user(U),
+         {ok, User} = rabbit_auth_backend_internal:lookup_user(U),
          rabbit_mgmt_format:internal_user(User)
-     end || {U, _} <- rabbit_access_control:list_users()].
+     end || {U, _} <- rabbit_auth_backend_internal:list_users()].
diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_wm_vhost.erl b/deps/rabbitmq_management/src/rabbit_mgmt_wm_vhost.erl
index 049ac18d21..369b841343 100644
--- a/deps/rabbitmq_management/src/rabbit_mgmt_wm_vhost.erl
+++ b/deps/rabbitmq_management/src/rabbit_mgmt_wm_vhost.erl
@@ -36,7 +36,7 @@ allowed_methods(ReqData, Context) ->
     {['HEAD', 'GET', 'PUT', 'DELETE'], ReqData, Context}.
 
 resource_exists(ReqData, Context) ->
-    {rabbit_access_control:vhost_exists(id(ReqData)), ReqData, Context}.
+    {rabbit_vhost:exists(id(ReqData)), ReqData, Context}.
 
 to_json(ReqData, Context) ->
     VHost = [{name, id(ReqData)}],
@@ -48,7 +48,7 @@ accept_content(ReqData, Context) ->
 
 delete_resource(ReqData, Context) ->
     VHost = id(ReqData),
-    rabbit_access_control:delete_vhost(VHost),
+    rabbit_vhost:delete(VHost),
     {true, ReqData, Context}.
 
 is_authorized(ReqData, Context) ->
@@ -60,7 +60,7 @@ id(ReqData) ->
     rabbit_mgmt_util:id(vhost, ReqData).
 
 put_vhost(VHost) ->
-    case rabbit_access_control:vhost_exists(VHost) of
+    case rabbit_vhost:exists(VHost) of
         true  -> ok;
-        false -> rabbit_access_control:add_vhost(VHost)
+        false -> rabbit_vhost:add(VHost)
     end.
diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_wm_vhosts.erl b/deps/rabbitmq_management/src/rabbit_mgmt_wm_vhosts.erl
index c5bcc09545..fd9aec25d9 100644
--- a/deps/rabbitmq_management/src/rabbit_mgmt_wm_vhosts.erl
+++ b/deps/rabbitmq_management/src/rabbit_mgmt_wm_vhosts.erl
@@ -38,7 +38,7 @@ is_authorized(ReqData, Context) ->
 %%--------------------------------------------------------------------
 
 vhosts() ->
-    format(rabbit_access_control:list_vhosts()).
+    format(rabbit_vhost:list()).
 
 format(Vs) ->
     [[{name, N}] || N <- Vs].