Can't know which user has made a search request

[raphaelbadawi]

Hello,

I have been struggling with the directory endpoint configured under the rest entry in ma1sd.yaml. In our current server configuration, it sends the request to a PHP application in another server.

But in this PHP application, the only data we actually receive are the "by" and "searchTerm" fields, which matches the structure of the class UserDirectorySearchRequest. But with this data we have no clue who did the search and thus we can't apply access rules in our response. Indeed, it's always the string "name" we get as a value under the "by" key.

I saw in DirectoryManager.java l. 82 that an "access_token" parameter is actually put in the URI with the POST request, but it's nowhere to be found in the data the requested server receives.

How can we know which user actually sent the request?

Thanks for you help,
Raphaël.