Customers cannot search for users in the customer portal request forms via email address when customer permissions are restricted

Summary

In JIRA Service Desk 3.2.6, administrators may configure a Service Desk's Request Security so that customers can see other users, when filling in a user field, if "they... enter the exact email or username in a user field".

In JIRA Service Desk 3.3.0+, the structure and wording of this functionality was changed slightly, and administrators may instead configure a Service Desk's Customer Permissions so that customers may share requests with "Any customer, by typing an email address".

In either case, customer's actually cannot fill in these users if they enter their full email address; only when using their full username. This is misleading and confusing in the circumstances where the user security is set and customers wish to pull in other customer's via email address (when they don't know the other customer's usernames).

See behavior in Service Desk 3.2.6:

See behavior in Service Desk 3.3.0:

Steps to Reproduce

1. Create a "User Picker (Single User)" custom field and associate it with the Service Desk screen
2. Modify a Request Type in the Service Desk so that the form incorporates that custom field
3. Depending on the version of Service Desk being used, configure Request Security (Service Desk 3.2.x and below) or Customer permissions (Service Desk 3.3.x and above) for the security option which allows customers to select other users if provided a full username/email address (no searching).

Expected Results

A customer should be allowed to fill out the form by providing either the full username or the full email address of the user they intend to add.

Actual Results

The error message "Please provide a valid value for field 'UserPicker'" is thrown, even if a valid email address is provided. Only the full username will be accepted.

Notes

• As of SDS 4.1.0, the user picker field suggestions do not work unless the permissions are set to "Any customer or organization, by searching in this project".
• The customer having the global "Browse users" permission does not change this behavior.

Workaround

1. Use the username of the user to be picked, rather than the email address (unless you're in JIRA Service Desk 3.16.+, step two is the only viable workaroud).
2. Change the Service Desk's Request Security/Customer permissions to "Any customer or organization, by searching in this project" to allow the suggestions to work in user picker fields.