...
The API has a list of search terms and search values. These are what's called the 'seed' (horrible term) that's passed into classes defined in personDirectoryContext.xml for searching. Typically the search terms are passed along to an LDAP search with an OR configuration (which is how personDirectoryContext.xml is normally configured, see https://wiki.jasig.org/display/UPM43/LDAP+User+Attribute+Sources). You can also review https://wiki.jasig.org/display/UPM43/Configuring+Search but it is more for the portal's Search not specifically for a person search. So a search of
/uPortal/api/people.json?searchTerms%5B%5D=givenName&searchTerms%5B%5D=sn&searchTerms%5B%5D=username&givenName=student&sn=student&username=student
this is saying search terms are givenName and username, and the values of both are student (and typically you have your LDAP search configured for OR comparisons; e.g. givenName=student OR username=student).
Permissions drive what attributes are allowed to be released to what type of user, and which users can be included in search results. For example in the 'default' uPortal 4.3.0 configuration:
- users that are included and excluded from search: https://github.com/Jasig/uPortal/blob/uportal-4.3.0/uportal-war/src/main/data/default_entities/permission_set/Authenticated_Users__VIEW_USER__UP_USERS.permission-set.xml
- Attributes allowed to be returned to what type of user (everyone in the default case but you could have different results for guest vs. authenticated, or staff/faculty vs. student): https://github.com/Jasig/uPortal/blob/uportal-4.3.0/uportal-war/src/main/data/default_entities/permission_set/Everyone__VIEW_USER_ATTRIBUTE__UP_USERS.permission-set.xml
[GET] /uPortal/api/people/{username}.json
[GET] /uPortal/layout.json (also at uPortal/api/v1/dlm/layout.json)
...