JSM Data Center: customer portal user-search endpoint has a hardcoded 10-result limit, making users

[Licence EGT]

Environment:

• Jira Service Management Data Center (version:v11.3.6#11030007)
• ~2,000+ users, single user directory (Active Directory, read-only with local groups)
• Customer Permissions: "Who can customers share requests with?" = "Any customer or organization, by searching in this project"

Problem description: When customers create a request from the Customer Portal, certain users never appear in user picker fields (single user picker custom fields), regardless of the search query entered. The same users are found without issue from the admin side. Affected users have healthy, active accounts.

Root cause identified through testing:

The portal user picker calls:

GET /rest/servicedesk/1/customer/user-search?query=<q>&fieldName=<cf>&projectId=<id>&fieldConfigId=<id>

We have established the following behavior of this endpoint:

1. It returns a maximum of 10 results, sorted alphabetically by display name.
2. The limit cannot be changed. Appending &limit=200 or &maxResults=200 is ignored (responses are byte-identical). The properties jira.userpicker.maxResults and jira.ajax.autocomplete.limit in jira-config.properties have no effect on this endpoint (verified via System Info after restart).
3. Matching is prefix-token based (query split on dots/spaces; each token prefix-matched against name tokens, username, and email).

Consequence — structurally unfindable users: For users whose first name is a prefix of their surname (e.g. "Ivan Ivanov", "Vasil Vasilev"), every possible query token also matches the entire surname cluster. Example: query vasil.vasilev tokenizes to vasil + vasilev, and the single word "Vasilev" satisfies both tokens, so all 37 users with surname Vasilev/Vasileva match. The target user sorts at position ~31 alphabetically and is therefore never returned. We verified there is no query string (full username, full email, name + department suffix) that brings this user into the top 10.

Evidence:

• GET /rest/api/2/user?username=vasil.vasilev → returns the user (account healthy, active, in jira-users, JSM application access)
• GET /rest/api/2/user/picker?query=vasilev&maxResults=200 → "Showing 93 of 93 matching users", target users included (index healthy)
• GET /rest/servicedesk/1/customer/user-search?query=vasilev&... → exactly 10 results, alphabetical, target user absent
• Same endpoint with &limit=200 and &maxResults=200 → identical 10 results

Questions / requests:

1. Is there any system property, dark feature, or configuration that controls the result limit of /rest/servicedesk/1/customer/user-search?
2. If not, we'd like to file this as a product defect/improvement: the result limit should be configurable, and/or exact username matches should be ranked above partial display-name matches, so that users are not permanently unfindable from the portal.

Business impact: Customers cannot select specific colleagues in approver/user picker fields on request forms, blocking normal request workflows. The affected name pattern is widespread in our user base, so this is not an isolated edge case.