diff --git a/rbac/check_perm.py b/rbac/check_perm.py
index 8de56f6..8e81b11 100644
--- a/rbac/check_perm.py
+++ b/rbac/check_perm.py
@@ -6,13 +6,14 @@ from appPublic.registerfunction import RegisterFunction
 from appPublic.rc4 import password, unpassword
 from appPublic.jsonConfig import getConfig
 from appPublic.log import debug, exception
-from ahserver.auth_api import AuthAPI
+from ahserver.auth_api import AuthAPI, user_login
 from ahserver.serverenv import ServerEnv
 import jwt
 
 defualt_password_key =  "!@#$%^&*(*&^%$QWERTYUIqwertyui234567"
 
 defualt_secret_key="test1234!@#$2222354"
+
 def generate_token(ak):
 	tim = int(round(time.time()))
 	exp = tim + 5 * 60
@@ -39,6 +40,18 @@ def get_apikey_from_token(token):
 	except:
 		return None
 
+async def get_user_roles():
+	userid = await get_user()
+	sql = "select b.name from userrole a, role b where a.userid=${userid}$ and a.roleid = b.id"
+	db = DBPools()
+	roles = []
+	async with db.sqlorContext(dbname) as sor:
+		recs = sor.sqlExe(sql, {'userid':userid})
+		if len(recs) < 1:
+			return roles
+		for r in recs:
+			roles.append(r.name)
+	return roles
 
 def mypassword(passwd):
 	config = getConfig()
@@ -51,9 +64,31 @@ def myunpassword(passwd):
 	return unpassword(passwd)
 
 def load_rbac():
+	AuthAPI.checkUserPermission = objcheckperm
 	env = ServerEnv()
 	env.password = mypassword
 	env.unpassword = myunpassword
+	env.get_user_roles = get_user_roles
+	env.check_user_password = checkUserPassword
+
+async def get_dbname():
+	rf = RegisterFunction()
+	dbname = await rf.exe('get_module_dbname', 'rbac')
+	return dbname
+
+async def checkUserPassword(request, username, password):
+	db = DBPools()
+	dbname = await get_dbname()
+	async with db.sqlorContext(dbname) as sor:
+		sql = "select * from users where username=${username}$ and password=${password}$"
+		recs = await sor.sqlExe(sql, {'username':username, 'password':password})
+		if len(recs) < 1:
+			return False
+		await user_login(request, recs[0].id, 
+							username=recs[0].username, 
+							userorgid=recs[0].orgid)
+		return True
+	return False
 
 async def getAuthenticationUserid(sor, request):
 	auth = request.headers.get('Authentication')
@@ -115,5 +150,3 @@ and c.del_flg='0'"""
 	debug(f'error happened {userid}, {path}')
 	return False
 
-AuthAPI.checkUserPermission = objcheckperm
-
diff --git a/requirements.txt b/requirements.txt
index ee4ba4f..34df19f 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1 +1,2 @@
 aiohttp
+PyJWT
diff --git a/wwwroot/userpassword_login.dspy b/wwwroot/userpassword_login.dspy
new file mode 100644
index 0000000..89386c2
--- /dev/null
+++ b/wwwroot/userpassword_login.dspy
@@ -0,0 +1,11 @@
+username = params_kw.get('username')
+passwd = params_kw.get('password')
+if not passwd:
+	return Error(title='Login failed', message='Password is required')
+passwd = password(passwd)
+rzt = await check_user_password(username, passwd):
+if rzt:
+	return Message(title='Logined', message=f'Welcome back {get_usernme()}')
+return Error(title='login failed', message='user and password mismatch')
+	
+		
diff --git a/wwwroot/userpassword_login.ui b/wwwroot/userpassword_login.ui
new file mode 100644
index 0000000..57debd7
--- /dev/null
+++ b/wwwroot/userpassword_login.ui
@@ -0,0 +1,43 @@
+{
+    "id":"login_window",
+    "widgettype":"PopupWindow",
+    "options":{
+        "auto_open":true,
+        "anthor":"cc",
+        "width":"70%",
+        "height":"70%"
+    },
+    "subwidgets":[
+		{
+			"widgettype":"Form",
+			"id":"userpasswd",
+			"options":{
+				"cols":1,
+				"fields":[
+					{
+						"name":"username",
+						"label":"用户名",
+						"uitype":"str"
+					},
+					{
+						"name":"passwd",
+						"label":"密码",
+						"uitype":"password"
+					}
+				]
+			}
+		}
+	],
+	"binds":[
+		{
+			"wid":"userpasswd",
+			"event":"submit",
+			"actiontype":"urlwidget",
+			"target":"self",
+			"options":{
+				"url":"{{entire_url('userpassword_login.dspy')}}"
+			}
+		}
+	]
+}
+