diff --git a/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserPrincipalProvider.java b/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserPrincipalProvider.java
index 18e747e7f3..a749b5b8aa 100644
--- a/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserPrincipalProvider.java
+++ b/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserPrincipalProvider.java
@@ -140,10 +140,21 @@ class UserPrincipalProvider implements PrincipalProvider {
         return principals;
     }
 
+    @Override
+    public Iterator<? extends Principal> findPrincipals(final String nameHint, final int searchType) {
+        return findPrincipals(nameHint, searchType, 0, -1);
+    }
+
     @NotNull
     @Override
-    public Iterator<? extends Principal> findPrincipals(final String nameHint,
-                                                        final int searchType) {
+    public Iterator<? extends Principal> findPrincipals(final String nameHint, final int searchType, long offset,
+            long limit) {
+        if (offset < 0) {
+            offset = 0;
+        }
+        if (limit < 0) {
+            limit = Long.MAX_VALUE;
+        }
         try {
             AuthorizableType type = AuthorizableType.getType(searchType);
             StringBuilder statement = new StringBuilder()
@@ -151,17 +162,19 @@ class UserPrincipalProvider implements PrincipalProvider {
                     .append("//element(*,").append(QueryUtil.getNodeTypeName(type)).append(')')
                     .append("[jcr:like(@rep:principalName,'")
                     .append(buildSearchPattern(nameHint))
-                    .append("')]");
+                    .append("')] order by @rep:principalName");
 
             Result result = root.getQueryEngine().executeQuery(
                     statement.toString(), javax.jcr.query.Query.XPATH,
-                    NO_BINDINGS, namePathMapper.getSessionLocalMappings());
+                    limit, offset, NO_BINDINGS, namePathMapper.getSessionLocalMappings());
 
             Iterator<Principal> principals = Iterators.filter(
                     Iterators.transform(result.getRows().iterator(), new ResultRowToPrincipal()),
                     Predicates.notNull());
 
-            if (matchesEveryone(nameHint, searchType)) {
+            // everyone is injected only in complete set, not on pages
+            boolean noRange = offset == 0 && limit == Long.MAX_VALUE;
+            if (noRange && matchesEveryone(nameHint, searchType)) {
                 principals = Iterators.concat(principals, Iterators.singletonIterator(EveryonePrincipal.getInstance()));
                 return Iterators.filter(principals, new EveryonePredicate());
             } else {