Currently the search operations in some REST resources can only take a keyword. It doesn't accept wildcards. If the user specifies a *, it will be escaped when the keyword is converted into an LDAP filter. So the * will be interpreted as a character literal, not a wildcard anymore.

Adding a support for wildcards might interfere with the ability to search for the * character itself. The user might need to escape the * when specifying the filter, which might be fine on CLI, but uncommon in the UI world. On the other hand, searching for * might be uncommon anyway.

A possible solution is to provide an option to users whether to use a keyword-based search filter like the current code or a regular expression.