I am prety sure when you purchase a ticket, you agree to the terms of sale.
If one of those terms is accepting being searched if required.
If you dont like the terms, dont go to the gig.
I am not being awkward here, I am a regular festival & gig patron and the increase in security over the last 5 or 6 years has sickened me, I find it an infringement on my civil liberties however, by turning up with ticket in hand, I am accepting whatever the promoter deems necesary.
As for "was the search legal?". Did your friend object to being searched? Were they pinned down and searched?
I think if your "friend" has issues with the outcome, they need legal representation.
I am in the Uk and our laws are different to the US. I dont have any legal experience or expertise, just trying to offer friendly suggestions. W