The UserManager does have an API for this, which you should use instead of directly using JCR query - https://dev.day.com/docs/en/cq/current/javadoc/org/apache/jackrabbit/api/security/user/UserManager.html#findAuthorizables(java.lang.String, java.lang.String, int). The reason this is preferrable is ...