Hello JingHong
User List is a necessary thing to know for user management.
You need to know the application server name to be able to get the list
What you can do is you can store the names of the application servers and then encrypt them
if you need to hide
Then read these and get the suer list behind the secene.
İn this way it can be configurable too
without knowing the applicatiion server name or IP it cant be possible to get the list