diff --git a/lib/galaxy/webapps/galaxy/api/users.py b/lib/galaxy/webapps/galaxy/api/users.py
index 2236969ebea..261a50f934a 100644
--- a/lib/galaxy/webapps/galaxy/api/users.py
+++ b/lib/galaxy/webapps/galaxy/api/users.py
@@ -113,10 +113,18 @@ class UserAPIController( BaseAPIController, UsesTagsMixin, CreatesUsersMixin, Cr
             item = user.to_dict( value_mapper={ 'id': trans.security.encode_id } )
             # If NOT configured to expose_email, do not expose email UNLESS the user is self, or
             # the user is an admin
-            if not trans.app.config.expose_user_name and user is not trans.user and not trans.user_is_admin():
-                del item['username']
-            if not trans.app.config.expose_user_email and user is not trans.user and not trans.user_is_admin():
-                del item['email']
+            if user is not trans.user and not trans.user_is_admin():
+                expose_keys = ["id"]
+                if trans.app.config.expose_user_name:
+                    expose_keys.append("username")
+                if trans.app.config.expose_user_email:
+                    expose_keys.append("email")
+                new_item = {}
+                for key, value in item.items():
+                    if key in expose_keys:
+                        new_item[key] = value
+                item = new_item
+
             # TODO: move into api_values
             rval.append( item )
         return rval
diff --git a/test/integration/test_config_options_users.py b/test/integration/test_config_options_users.py
new file mode 100644
index 00000000000..ff74a4eff81
--- /dev/null
+++ b/test/integration/test_config_options_users.py
@@ -0,0 +1,58 @@
+"""Integration tests for user config options."""
+
+from base import integration_util
+
+
+class _BaseUserExposeIntegerationTestCase(integration_util.IntegrationTestCase):
+
+    def original_user_ids(self):
+        return [u["id"] for u in self.galaxy_interactor.get("users").json()]
+
+    def new_users(self, original_ids):
+        users = [u for u in self.galaxy_interactor.get("users").json() if u["id"] not in original_ids]
+        return users
+
+
+class DefaultUserExposeIntegrationTestCase(_BaseUserExposeIntegerationTestCase):
+
+    def test_defaults(self):
+        original_user_ids = self.original_user_ids()
+        self.galaxy_interactor.ensure_user_with_email("defaultuserexposetest@galaxyproject.org")
+        new_users = self.new_users(original_user_ids)
+        # If expose username or expose email isn't enabled - user indexing is
+        # empty by default for non-admin users.
+        assert len(new_users) == 0
+
+
+class EmailUserExposeIntegrationTestCase(_BaseUserExposeIntegerationTestCase):
+
+    @classmethod
+    def handle_galaxy_config_kwds(cls, config):
+        config["expose_user_email"] = True
+
+    def test_only_email_exposed(self):
+        original_user_ids = self.original_user_ids()
+        self.galaxy_interactor.ensure_user_with_email("emailuserexposetest@galaxyproject.org")
+        new_users = self.new_users(original_user_ids)
+        assert len(new_users) > 0
+        user = new_users[0]
+        assert "email" in user
+        assert "username" not in user
+        assert "last_password_change" not in user
+
+
+class UsernameUserExposeIntegrationTestCase(_BaseUserExposeIntegerationTestCase):
+
+    @classmethod
+    def handle_galaxy_config_kwds(cls, config):
+        config["expose_user_name"] = True
+
+    def test_only_username_exposed(self):
+        original_user_ids = self.original_user_ids()
+        self.galaxy_interactor.ensure_user_with_email("usernameuserexposetest@galaxyproject.org")
+        new_users = self.new_users(original_user_ids)
+        assert len(new_users) > 0
+        user = new_users[0]
+        assert "email" not in user
+        assert "username" in user
+        assert "last_password_change" not in user