diff --git a/js/controller/BoardController.js b/js/controller/BoardController.js
index d98ebde82..f5f71b219 100644
--- a/js/controller/BoardController.js
+++ b/js/controller/BoardController.js
@@ -126,7 +126,14 @@ app.controller('BoardController', function ($rootScope, $scope, $stateParams, St
 
 
 
-  BoardService.searchUsers();
+  BoardService.searchUsers('%25');
+
+  $scope.searchForUser = function(search) {
+    if(search=="") {
+      search = "%25";
+    }
+    BoardService.searchUsers(search);
+  }
 
   $scope.newStack = { 'boardId': $scope.id};
   $scope.newCard = {};
diff --git a/js/public/app.js b/js/public/app.js
index 9e624223f..a0072ad77 100644
--- a/js/public/app.js
+++ b/js/public/app.js
@@ -223,7 +223,14 @@ app.controller('BoardController', ["$rootScope", "$scope", "$stateParams", "Stat
 
 
 
-  BoardService.searchUsers();
+  BoardService.searchUsers('%25');
+
+  $scope.searchForUser = function(search) {
+    if(search=="") {
+      search = "%25";
+    }
+    BoardService.searchUsers(search);
+  }
 
   $scope.newStack = { 'boardId': $scope.id};
   $scope.newCard = {};
@@ -859,13 +866,26 @@ app.factory('BoardService', ["ApiService", "$http", "$q", function(ApiService, $
     };
     BoardService.prototype = angular.copy(ApiService.prototype);
 
-    BoardService.prototype.searchUsers = function() {
-        var url = OC.generateUrl('/apps/deck/share/search/%');
+    BoardService.prototype.searchUsers = function(search) {
+        var url = OC.generateUrl('/apps/deck/share/search/'+search);
         var deferred = $q.defer();
         var self = this;
-        this.sharees = [];
         $http.get(url).then(function (response) {
-            self.sharees = response.data;
+
+            self.sharees = [];
+            // filter out everyone who is already in the share list
+            angular.forEach(response.data, function(item) {
+                var exists = false;
+                angular.forEach(self.getCurrent().acl, function(acl) {
+                    if (acl.participant === item.participant) {
+                        exists = true;
+                    }
+                });
+                if(!exists) {
+                    self.sharees.push(item);
+                }
+            });
+
             deferred.resolve(response.data);
         }, function (error) {
             deferred.reject('Error while update ' + self.endpoint);
diff --git a/js/service/BoardService.js b/js/service/BoardService.js
index a638e15aa..73b39a5ea 100644
--- a/js/service/BoardService.js
+++ b/js/service/BoardService.js
@@ -26,13 +26,26 @@ app.factory('BoardService', function(ApiService, $http, $q){
     };
     BoardService.prototype = angular.copy(ApiService.prototype);
 
-    BoardService.prototype.searchUsers = function() {
-        var url = OC.generateUrl('/apps/deck/share/search/%');
+    BoardService.prototype.searchUsers = function(search) {
+        var url = OC.generateUrl('/apps/deck/share/search/'+search);
         var deferred = $q.defer();
         var self = this;
-        this.sharees = [];
         $http.get(url).then(function (response) {
-            self.sharees = response.data;
+
+            self.sharees = [];
+            // filter out everyone who is already in the share list
+            angular.forEach(response.data, function(item) {
+                var exists = false;
+                angular.forEach(self.getCurrent().acl, function(acl) {
+                    if (acl.participant === item.participant) {
+                        exists = true;
+                    }
+                });
+                if(!exists) {
+                    self.sharees.push(item);
+                }
+            });
+
             deferred.resolve(response.data);
         }, function (error) {
             deferred.reject('Error while update ' + self.endpoint);
diff --git a/lib/Controller/ShareController.php b/lib/Controller/ShareController.php
index c07c05097..baba2cf81 100644
--- a/lib/Controller/ShareController.php
+++ b/lib/Controller/ShareController.php
@@ -26,14 +26,15 @@ namespace OCA\Deck\Controller;
 use OCA\Deck\Db\Acl;
 use OCP\IGroupManager;
 use OCP\IRequest;
-use OCP\AppFramework\ApiController as BaseApiController;
 use OCP\AppFramework\Controller;
 use OCP\IUserManager;
+
 class ShareController extends Controller {
 
     protected $userManager;
     protected $groupManager;
     private $userId;
+
     public function __construct($appName,
                                 IRequest $request,
                                 IUserManager $userManager,
@@ -48,9 +49,10 @@ class ShareController extends Controller {
     }
     /**
      * @NoAdminRequired
+	 * @RequireNoPermission
      */
     public function searchUser($search) {
-        $limit = null;
+        $limit = 3;
         $offset = null;
         $result = [];
         foreach ($this->groupManager->search($search, $limit, $offset) as $idx => $group) {
@@ -62,6 +64,7 @@ class ShareController extends Controller {
             $acl->setPermissionManage(true);
             $result[] = $acl;
         }
+        $limit = 10;
         foreach ($this->userManager->searchDisplayName($search, $limit, $offset) as $idx => $user) {
             if($user->getUID() === $this->userId)
                 continue;
diff --git a/lib/NotFoundException.php b/lib/NotFoundException.php
new file mode 100644
index 000000000..f48e979fd
--- /dev/null
+++ b/lib/NotFoundException.php
@@ -0,0 +1,35 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016 Julius Härtl <jus@bitgrid.net>
+ *
+ * @author Julius Härtl <jus@bitgrid.net>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ *  This program is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU Affero General Public License as
+ *  published by the Free Software Foundation, either version 3 of the
+ *  License, or (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU Affero General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Affero General Public License
+ *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace OCA\Deck;
+
+
+class NoPermissionException extends \Exception {
+
+	public function __construct($message, $controller=null, $method=null) {
+		parent::__construct($message);
+		if($controller && $method) {
+			$this->message = get_class($controller) . "#" . $method . ": " . $message;
+		}
+	}
+}
\ No newline at end of file
diff --git a/templates/part.board.sidebarView.php b/templates/part.board.sidebarView.php
index 2e93b0a06..b3226989b 100644
--- a/templates/part.board.sidebarView.php
+++ b/templates/part.board.sidebarView.php
@@ -21,8 +21,8 @@
             <ui-select-match placeholder="<?php p($l->t('Select users...')); ?>">
                 <span><i class="icon icon-{{$item.type}}"></i> {{ $item.participant }}</span>
             </ui-select-match>
-            <!-- FIXME: filter by selected or add multiple //-->
-            <ui-select-choices repeat="sharee in boardservice.sharees | filter: board.sharees | filter: $select.search track by $index">
+            <ui-select-choices refresh="searchForUser($select.search)"
+                               refresh-delay="0" repeat="sharee in boardservice.sharees">
                 <span><i class="icon icon-{{sharee.type}}"></i> {{ sharee.participant }}</span>
             </ui-select-choices>
             <ui-select-no-choice>