Login not possibile: Missing decoding Spaces in UserId in Rest Call flowable-idm/api/idm/users

We are using LDAP (aktive directory) to authenticate with flowable with the AD distinguishedName as user-id attribute. If this distinguishedName contains Spaces, the user can authenticate on the IDM, but the TASK/Modeller App does not accept the auth and redirects to login again. Looking to the Debug console the problems comes more clear:

The TASK App call a Rest call to get user details:
/flowable-idm/api/idm/users/CN%3DPippo+Pluto%2COU%3DUsers+Italy%2COU%3DMyOu%2CDC%3DExample%2CDC%3DLOCALE

Debug output - As you can see the Value passt to the SQL Query (on IDM site) contains the + (Plus) sign and there is no result:

2018-10-31 13:38:55.987 DEBUG 1 --- [nio-8080-exec-7] o.f.c.e.i.i.LogInterceptor : --- starting PrivilegeQueryImpl --------------------------------------------------------
2018-10-31 13:38:55.987 DEBUG 1 --- [nio-8080-exec-7] o.f.i.s.SpringTransactionInterceptor : Running command with propagation REQUIRED
2018-10-31 13:38:55.987 DEBUG 1 --- [nio-8080-exec-7] o.s.j.d.DataSourceTransactionManager : Participating in existing transaction
2018-10-31 13:38:55.987 DEBUG 1 --- [nio-8080-exec-7] e.i.p.e.P.selectPrivilegeByQueryCriteria : ==> Preparing: select RES.* from ACT_ID_PRIV RES WHERE exists(select 1 from ACT_ID_PRIV_MAPPING mapping where RES.ID_ = mapping.PRIV_ID_ and mapping.USER_ID_ = ?) order by RES.ID_ asc
2018-10-31 13:38:55.987 DEBUG 1 --- [nio-8080-exec-7] e.i.p.e.P.selectPrivilegeByQueryCriteria : ==> **Parameters: CN=Pippo+Pluto,OU=Users+Italy,OU=MyOu,DC=Example,DC=LOCALE(String)**
2018-10-31 13:38:55.988 DEBUG 1 --- [nio-8080-exec-7] e.i.p.e.P.selectPrivilegeByQueryCriteria : <== **Total: 0**
2018-10-31 13:38:55.989 DEBUG 1 --- [nio-8080-exec-7] o.f.c.e.i.d.DbSqlSession : Flushing dbSqlSession
2018-10-31 13:38:55.989 DEBUG 1 --- [nio-8080-exec-7] o.f.c.e.i.d.DbSqlSession : flush summary: 0 insert, 0 update, 0 delete.
2018-10-31 13:38:55.989 DEBUG 1 --- [nio-8080-exec-7] o.f.c.e.i.d.DbSqlSession : now executing flush...
2018-10-31 13:38:55.989 DEBUG 1 --- [nio-8080-exec-7] o.f.c.e.i.i.LogInterceptor : --- PrivilegeQueryImpl finished --------------------------------------------------------

Inizia tracciando la chiamata REST a /flowable-idm/api/idm/users/{userId} e confronta il suo ID utente decodificato dall’URL con il parametro SQL mostrato nell’output di debug. Il lavoro è completato quando un distinguished name di Active Directory contenente spazi viene decodificato in modo coerente e la ricerca IDM restituisce l’utente autenticato per le applicazioni TASK e Modeller.

Scritto dal modello di indicizzazione a partire dal testo della issue.