class GetUsersByPrivilegeAndGroupAPIController {

    @RequestMapping(method = RequestMethod.GET, value = "/users/{privilege}/{group}", produces = MediaType.APPLICATION_JSON_VALUE)
    public @ResponseBody List<AcmUser> usersByPrivilegeAndGroup(@PathVariable(value = "privilege") String privilege,
            @PathVariable(value = "group") String group)
    {
        if (log.isDebugEnabled())
        {
            log.debug("Looking for users for privilege '" + privilege + "' and group " + group);
        }

        List<AcmUser> retval = new ArrayList<>();

        List<String> rolesForPrivilege = getPluginManager().getRolesForPrivilege(privilege);
        Map<String, List<String>> rolesToGroups = getFunctionalAccessService().getApplicationRolesToGroups();

        // Creating set to avoid duplicates. AcmUser has overrided "equals" and "hasCode" methods
        Set<AcmUser> users = getFunctionalAccessService().getUsersByRolesAndGroups(rolesForPrivilege, rolesToGroups, group, null);

        retval.addAll(users);

        return retval;
    }

}