diff --git a/gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/model/Permission.java b/gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/model/Permission.java
index 0d5c72d..53f3199 100644
--- a/gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/model/Permission.java
+++ b/gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/model/Permission.java
@@ -42,6 +42,11 @@
   private String type;
 
   /**
+   * 菜单图标
+   */
+  private String icon;
+
+  /**
    * URL地址
    */
   private String url;
diff --git a/gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/model/PermissionRoleSet.java b/gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/model/PermissionRoleSet.java
new file mode 100644
index 0000000..675e657
--- /dev/null
+++ b/gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/model/PermissionRoleSet.java
@@ -0,0 +1,5 @@
+package com.supwisdom.institute.backend.gateway.authn.model;
+
+public class PermissionRoleSet {
+
+}
diff --git a/gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/model/ResourceRoleSet.java b/gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/model/ResourceRoleSet.java
new file mode 100644
index 0000000..2d7940c
--- /dev/null
+++ b/gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/model/ResourceRoleSet.java
@@ -0,0 +1,80 @@
+package com.supwisdom.institute.backend.gateway.authn.model;
+
+import java.util.Collection;
+
+import com.supwisdom.institute.backend.common.framework.model.ABaseModel;
+
+import lombok.Getter;
+import lombok.Setter;
+
+public class ResourceRoleSet extends ABaseModel {
+
+  /**
+   * 
+   */
+  private static final long serialVersionUID = -683204173918706673L;
+
+  public static final String ACCESS_ANONYMOUS = "anonymous"; // 匿名访问anonymous
+  public static final String ACCESS_AUTHENTICATE = "authenticate"; // 认证访问authenticate
+  public static final String ACCESS_AUTHORIZE = "authorize"; // 授权访问authorize
+  public static final String ACCESS_PERMIT_ALL = "permitAll"; // 允许所有permitAll
+  public static final String ACCESS_DENY_ALL = "denyAll"; // 拒绝所有denyAll
+
+  @Getter
+  @Setter
+  private String id;
+
+  /**
+   * 代码
+   */
+  @Getter
+  @Setter
+  private String code;
+
+  /**
+   * 名称
+   */
+  @Getter
+  @Setter
+  private String name;
+
+  /**
+   * 备注
+   */
+  @Getter
+  @Setter
+  private String memo;
+
+  /**
+   * 状态（1 启用，0 停用）
+   */
+  @Getter
+  @Setter
+  private String status;
+
+  /**
+   * 请求方式（GET、POST、PUT、DELETE 等）
+   */
+  @Getter
+  @Setter
+  private String method;
+
+  /**
+   * 请求路径
+   */
+  @Getter
+  @Setter
+  private String path;
+
+  /**
+   * 访问规则（匿名访问anonymous、认证访问authenticate、授权访问authorize、允许所有permitAll、拒绝所有denyAll）
+   */
+  @Getter
+  @Setter
+  private String access;
+
+  @Getter
+  @Setter
+  Collection<Role> roles;
+  
+}
diff --git a/gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/model/Route.java b/gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/model/Route.java
new file mode 100644
index 0000000..9ca66c6
--- /dev/null
+++ b/gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/model/Route.java
@@ -0,0 +1,68 @@
+package com.supwisdom.institute.backend.gateway.authn.model;
+
+import com.supwisdom.institute.backend.common.framework.model.ABaseModel;
+
+import lombok.Getter;
+import lombok.Setter;
+
+public class Route extends ABaseModel {
+
+  /**
+   * 
+   */
+  private static final long serialVersionUID = 1254295553813507087L;
+
+  @Getter
+  @Setter
+  private String id;
+
+  /**
+   * 代码
+   */
+  @Getter
+  @Setter
+  private String code;
+
+  /**
+   * 名称
+   */
+  @Getter
+  @Setter
+  private String name;
+
+  /**
+   * 备注
+   */
+  @Getter
+  @Setter
+  private String memo;
+
+  /**
+   * 状态（1 启用，0 停用）
+   */
+  @Getter
+  @Setter
+  private String status;
+
+  /**
+   * 路径前缀
+   */
+  @Getter
+  @Setter
+  private String pathPrefix;
+
+  /**
+   * 路由地址
+   */
+  @Getter
+  @Setter
+  private String url;
+
+  /**
+   * 是否排除前缀
+   */
+  @Getter
+  @Setter
+  private Boolean stripPrefix;
+
+}
diff --git a/gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/remote/configuration/AuthnAccountRestTemplateConfig.java b/gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/remote/configuration/AuthnRestTemplateConfig.java
similarity index 71%
rename from gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/remote/configuration/AuthnAccountRestTemplateConfig.java
rename to gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/remote/configuration/AuthnRestTemplateConfig.java
index 5e98c4a..789f930 100644
--- a/gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/remote/configuration/AuthnAccountRestTemplateConfig.java
+++ b/gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/remote/configuration/AuthnRestTemplateConfig.java
@@ -17,7 +17,7 @@
 import org.springframework.web.client.RestTemplate;
 
 @Configuration
-public class AuthnAccountRestTemplateConfig {
+public class AuthnRestTemplateConfig {
 
   @Bean
   public ClientHttpRequestFactory simpleClientHttpRequestFactory(
@@ -35,6 +35,21 @@
       return factory;
     }
     
+    SSLContextBuilder sslContextBuilder = SSLContexts.custom();
+    
+    if (trustStore == null || trustStore.isEmpty()) {
+    } else {
+      try {
+        sslContextBuilder
+          .loadTrustMaterial(
+              ResourceUtils.getFile(trustStore),
+              trustStorePassword.toCharArray()
+          );
+      } catch (Exception e) {
+        e.printStackTrace();
+      }
+    }
+    
     if (keyStore == null || keyStore.isEmpty()) {
       SimpleClientHttpRequestFactory factory = new SimpleClientHttpRequestFactory();
       factory.setReadTimeout(5000);// 单位为ms
@@ -42,42 +57,35 @@
       return factory;
     } else {
       try {
-        SSLContextBuilder sslContextBuilder = SSLContexts.custom();
-        if (trustStore == null || trustStore.isEmpty()) {
-        } else {
-          sslContextBuilder
-//            .loadTrustMaterial(TrustAllStrategy.INSTANCE)
-            .loadTrustMaterial(
-                ResourceUtils.getFile(trustStore),
-                trustStorePassword.toCharArray()
-            );
-        }
-        
         sslContextBuilder
           .loadKeyMaterial(
               ResourceUtils.getFile(keyStore),
               keyStorePassword.toCharArray(),
               keyPassword.toCharArray());
-        
-        SSLContext sslContext = sslContextBuilder.build();
-    
-        SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(
-            sslContext,
-            SSLConnectionSocketFactory.getDefaultHostnameVerifier());
-        
-        CloseableHttpClient httpClient = HttpClients.custom()
-            .setSSLSocketFactory(sslsf)
-            .build();
-        
-        HttpComponentsClientHttpRequestFactory factory = new HttpComponentsClientHttpRequestFactory(httpClient);
-        factory.setReadTimeout(5000);// 单位为ms
-        factory.setConnectTimeout(5000);// 单位为ms
-        return factory;
       } catch (Exception e) {
         e.printStackTrace();
       }
     }
     
+    try {
+      SSLContext sslContext = sslContextBuilder.build();
+  
+      SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(
+          sslContext,
+          SSLConnectionSocketFactory.getDefaultHostnameVerifier());
+      
+      CloseableHttpClient httpClient = HttpClients.custom()
+          .setSSLSocketFactory(sslsf)
+          .build();
+      
+      HttpComponentsClientHttpRequestFactory factory = new HttpComponentsClientHttpRequestFactory(httpClient);
+      factory.setReadTimeout(5000);// 单位为ms
+      factory.setConnectTimeout(5000);// 单位为ms
+      return factory;
+    } catch (Exception e) {
+      e.printStackTrace();
+    }
+    
     SimpleClientHttpRequestFactory factory = new SimpleClientHttpRequestFactory();
     factory.setReadTimeout(5000);// 单位为ms
     factory.setConnectTimeout(5000);// 单位为ms
diff --git a/gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/remote/web/client/AuthnAccountRemoteRestTemplate.java b/gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/remote/web/client/AuthnRemoteRestTemplate.java
similarity index 64%
rename from gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/remote/web/client/AuthnAccountRemoteRestTemplate.java
rename to gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/remote/web/client/AuthnRemoteRestTemplate.java
index 6259608..17a3430 100644
--- a/gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/remote/web/client/AuthnAccountRemoteRestTemplate.java
+++ b/gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/remote/web/client/AuthnRemoteRestTemplate.java
@@ -12,10 +12,10 @@
 
 @Slf4j
 @Component
-public class AuthnAccountRemoteRestTemplate {
+public class AuthnRemoteRestTemplate {
   
   @Autowired
-  private RestTemplate authnAccountRestTemplate;
+  private RestTemplate authnRestTemplate;
   
   @Value(value = "${sw-backend-base-api.uri}/v1/authn")
   private String url;
@@ -37,7 +37,7 @@
       final String url = this.url + StringUtils.replaceEach(path, new String[] {"{username}"}, new String[] {username});
       log.debug(url);
       
-      return authnAccountRestTemplate.getForObject(url, JSONObject.class);
+      return authnRestTemplate.getForObject(url, JSONObject.class);
     } catch (Exception e) {
       e.printStackTrace();
       
@@ -45,14 +45,14 @@
     }
   }
 
-  public JSONObject roles(String username) {
+  public JSONObject accountRoles(String username) {
 
     try {
       final String path = "/{username}/roles";
       final String url = this.url + StringUtils.replaceEach(path, new String[] {"{username}"}, new String[] {username});
       log.debug(url);
       
-      return authnAccountRestTemplate.getForObject(url, JSONObject.class);
+      return authnRestTemplate.getForObject(url, JSONObject.class);
     } catch (Exception e) {
       e.printStackTrace();
       
@@ -60,14 +60,14 @@
     }
   }
 
-  public JSONObject applications(String username, String applicationId) {
+  public JSONObject accountApplications(String username, String applicationId) {
 
     try {
       final String path = "/{username}/applications";
       final String url = this.url + StringUtils.replaceEach(path, new String[] {"{username}"}, new String[] {username});
       log.debug(url);
       
-      return authnAccountRestTemplate.getForObject(url, JSONObject.class);
+      return authnRestTemplate.getForObject(url, JSONObject.class);
     } catch (Exception e) {
       e.printStackTrace();
       
@@ -75,14 +75,14 @@
     }
   }
 
-  public JSONObject menus(String username, String applicationId) {
+  public JSONObject accountMenus(String username, String applicationId) {
 
     try {
       final String path = "/{username}/menus";
       final String url = this.url + StringUtils.replaceEach(path, new String[] {"{username}"}, new String[] {username});
       log.debug(url);
       
-      return authnAccountRestTemplate.getForObject(url, JSONObject.class);
+      return authnRestTemplate.getForObject(url, JSONObject.class);
     } catch (Exception e) {
       e.printStackTrace();
       
@@ -90,14 +90,14 @@
     }
   }
 
-  public JSONObject operations(String username, String applicationId) {
+  public JSONObject accountOperations(String username, String applicationId) {
 
     try {
       final String path = "/{username}/operations";
       final String url = this.url + StringUtils.replaceEach(path, new String[] {"{username}"}, new String[] {username});
       log.debug(url);
       
-      return authnAccountRestTemplate.getForObject(url, JSONObject.class);
+      return authnRestTemplate.getForObject(url, JSONObject.class);
     } catch (Exception e) {
       e.printStackTrace();
       
@@ -105,14 +105,45 @@
     }
   }
 
-  public JSONObject resources(String username, String applicationId) {
+  public JSONObject accountResources(String username, String applicationId) {
 
     try {
       final String path = "/{username}/resources";
       final String url = this.url + StringUtils.replaceEach(path, new String[] {"{username}"}, new String[] {username});
       log.debug(url);
       
-      return authnAccountRestTemplate.getForObject(url, JSONObject.class);
+      return authnRestTemplate.getForObject(url, JSONObject.class);
+    } catch (Exception e) {
+      e.printStackTrace();
+      
+      return defaultErrorJson(e);
+    }
+  }
+
+  public JSONObject resourceRoleSets() {
+
+    try {
+      final String path = "/resourceRoleSets";
+      final String url = this.url + path;
+      log.debug(url);
+      
+      return authnRestTemplate.getForObject(url, JSONObject.class);
+    } catch (Exception e) {
+      e.printStackTrace();
+      
+      return defaultErrorJson(e);
+    }
+  }
+
+
+  public JSONObject routes() {
+
+    try {
+      final String path = "/routes";
+      final String url = this.url + path;
+      log.debug(url);
+      
+      return authnRestTemplate.getForObject(url, JSONObject.class);
     } catch (Exception e) {
       e.printStackTrace();
       
diff --git a/gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/service/AuthnAccountService.java b/gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/service/AuthnAccountService.java
deleted file mode 100644
index beeb74a..0000000
--- a/gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/service/AuthnAccountService.java
+++ /dev/null
@@ -1,71 +0,0 @@
-package com.supwisdom.institute.backend.gateway.authn.service;
-
-import java.util.List;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.stereotype.Service;
-
-import com.alibaba.fastjson.JSONObject;
-import com.supwisdom.institute.backend.gateway.authn.model.Account;
-import com.supwisdom.institute.backend.gateway.authn.model.Permission;
-import com.supwisdom.institute.backend.gateway.authn.model.Role;
-import com.supwisdom.institute.backend.gateway.authn.remote.web.client.AuthnAccountRemoteRestTemplate;
-
-@Service
-public class AuthnAccountService {
-  
-//  @Autowired
-//  private AuthnAccountRemoteFeignClient authnAccountRemote;
-  
-  @Autowired
-  private AuthnAccountRemoteRestTemplate authnAccountRemote;
-  
-  public Account account(String username) {
-    
-    JSONObject jsonObject = authnAccountRemote.account(username);
-    if (jsonObject == null) {
-      return null;
-    }
-    
-    if (jsonObject.getIntValue("code") == 0) {
-      JSONObject data = jsonObject.getJSONObject("data");
-      
-      return data.toJavaObject(Account.class);
-    }
-    
-    return null;
-  }
-
-  public List<Role> roles(String username) {
-    
-    JSONObject jsonObject = authnAccountRemote.roles(username);
-    if (jsonObject == null) {
-      return null;
-    }
-    
-    if (jsonObject.getIntValue("code") == 0) {
-      JSONObject data = jsonObject.getJSONObject("data");
-      
-      return data.getJSONArray("roles").toJavaList(Role.class);
-    }
-    
-    return null;
-  }
-
-  public List<Permission> menus(String username, String applicationId) {
-    
-    JSONObject jsonObject = authnAccountRemote.menus(username, applicationId);
-    if (jsonObject == null) {
-      return null;
-    }
-    
-    if (jsonObject.getIntValue("code") == 0) {
-      JSONObject data = jsonObject.getJSONObject("data");
-      
-      return data.getJSONArray("permissions").toJavaList(Permission.class);
-    }
-    
-    return null;
-  }
-
-}
diff --git a/gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/service/AuthnService.java b/gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/service/AuthnService.java
new file mode 100644
index 0000000..13434ec
--- /dev/null
+++ b/gateway/src/main/java/com/supwisdom/institute/backend/gateway/authn/service/AuthnService.java
@@ -0,0 +1,92 @@
+package com.supwisdom.institute.backend.gateway.authn.service;
+
+import java.util.List;
+
+import lombok.extern.slf4j.Slf4j;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+
+import com.alibaba.fastjson.JSONObject;
+import com.supwisdom.institute.backend.gateway.authn.model.Account;
+import com.supwisdom.institute.backend.gateway.authn.model.ResourceRoleSet;
+import com.supwisdom.institute.backend.gateway.authn.model.Role;
+import com.supwisdom.institute.backend.gateway.authn.model.Route;
+import com.supwisdom.institute.backend.gateway.authn.remote.web.client.AuthnRemoteRestTemplate;
+
+@Slf4j
+@Service
+public class AuthnService {
+  
+  @Autowired
+  private AuthnRemoteRestTemplate authnRemote;
+  
+  public Account account(String username) {
+    
+    JSONObject jsonObject = authnRemote.account(username);
+    if (jsonObject == null) {
+      return null;
+    }
+    log.debug("{}", jsonObject.toJSONString());
+    
+    if (jsonObject.getIntValue("code") == 0) {
+      JSONObject data = jsonObject.getJSONObject("data");
+      
+      return data.toJavaObject(Account.class);
+    }
+    
+    return null;
+  }
+
+  public List<Role> accountRoles(String username) {
+    
+    JSONObject jsonObject = authnRemote.accountRoles(username);
+    if (jsonObject == null) {
+      return null;
+    }
+    log.debug("{}", jsonObject.toJSONString());
+    
+    if (jsonObject.getIntValue("code") == 0) {
+      JSONObject data = jsonObject.getJSONObject("data");
+      
+      return data.getJSONArray("roles").toJavaList(Role.class);
+    }
+    
+    return null;
+  }
+
+  public List<ResourceRoleSet> resourceRoleSets() {
+    
+    JSONObject jsonObject = authnRemote.resourceRoleSets();
+    if (jsonObject == null) {
+      return null;
+    }
+    log.debug("{}", jsonObject.toJSONString());
+    
+    if (jsonObject.getIntValue("code") == 0) {
+      JSONObject data = jsonObject.getJSONObject("data");
+      
+      return data.getJSONArray("resourceRoleSets").toJavaList(ResourceRoleSet.class);
+    }
+    
+    return null;
+  }
+
+  public List<Route> routes() {
+    
+    JSONObject jsonObject = authnRemote.routes();
+    if (jsonObject == null) {
+      return null;
+    }
+    log.debug("{}", jsonObject.toJSONString());
+    
+    if (jsonObject.getIntValue("code") == 0) {
+      JSONObject data = jsonObject.getJSONObject("data");
+      
+      return data.getJSONArray("routes").toJavaList(Route.class);
+    }
+    
+    return null;
+  }
+
+}
diff --git a/gateway/src/main/java/com/supwisdom/institute/backend/gateway/filter/AccessControlGlobalFilter.java b/gateway/src/main/java/com/supwisdom/institute/backend/gateway/filter/AccessControlGlobalFilter.java
index 266dfa7..6ef6b7e 100644
--- a/gateway/src/main/java/com/supwisdom/institute/backend/gateway/filter/AccessControlGlobalFilter.java
+++ b/gateway/src/main/java/com/supwisdom/institute/backend/gateway/filter/AccessControlGlobalFilter.java
@@ -4,6 +4,7 @@
 import java.util.Collection;
 import java.util.Collections;
 import java.util.Iterator;
+import java.util.List;
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
 
@@ -11,6 +12,7 @@
 import lombok.Getter;
 import lombok.extern.slf4j.Slf4j;
 
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.cloud.gateway.filter.GatewayFilterChain;
 import org.springframework.cloud.gateway.filter.GlobalFilter;
 import org.springframework.core.Ordered;
@@ -30,14 +32,15 @@
 import org.springframework.web.server.ServerWebExchange;
 
 import com.supwisdom.infras.security.core.userdetails.InfrasUser;
+import com.supwisdom.institute.backend.gateway.authn.model.ResourceRoleSet;
+import com.supwisdom.institute.backend.gateway.authn.model.Role;
+import com.supwisdom.institute.backend.gateway.authn.service.AuthnService;
 
 import reactor.core.publisher.Mono;
 
-//import static org.springframework.cloud.gateway.support.ServerWebExchangeUtils.GATEWAY_REQUEST_URL_ATTR;
-
 @Slf4j
 public class AccessControlGlobalFilter implements GlobalFilter, Ordered {
-
+  
   @Override
   public int getOrder() {
     return Ordered.HIGHEST_PRECEDENCE;
@@ -48,17 +51,17 @@
     log.debug("AccessControlGlobalFilter.filter");
     
     // 获取 请求路径 对应的 资源
-    Collection<ConfigAttribute> attributes = this.getAttributes(exchange);
-    log.debug("request's attributes is {}", attributes);
+    Collection<ConfigAttribute> configAttributes = this.getAttributes(exchange);
+    log.debug("request's attributes is {}", configAttributes);
     
     // 判断 该资源 是否需要登录才能访问
-    if (attributes == null) {
+    if (configAttributes == null || configAttributes.size() <= 0) {
       return chain.filter(exchange);  // FIXME: 
     }
     
     // 获取 当前登录用户（包括角色信息）
     
-    // 判断 登录用户 是否可以访问 该资源
+    // FIXME: 判断 登录用户 是否可以访问 该资源
     
     return ReactiveSecurityContextHolder.getContext()
         .filter(c -> {
@@ -72,7 +75,32 @@
           
           boolean hasPermission = false;
           
-          for (ConfigAttribute ca : attributes) {
+          ConfigAttribute ca;
+          String needRole;
+          for (Iterator<ConfigAttribute> iter = configAttributes.iterator(); iter.hasNext();) {
+            ca = iter.next();
+            needRole = ca.getAttribute();
+            
+            if (needRole == null || needRole.isEmpty()) {
+              continue;
+            }
+            
+            if (needRole.startsWith("ACCESS_")) {
+              String access = needRole.substring("ACCESS_".length()); log.debug("Access is {}", access);
+              if ("anonymous".equals(access)) {
+                hasPermission = false;
+              } else if ("authenticate".equals(access)) {
+                hasPermission = true;
+              } else if ("permitAll".equals(access)) {
+                hasPermission = true;
+              } else if ("denyAll".equals(access)) {
+                hasPermission = false;
+              } else {
+                hasPermission = false;
+              }
+              break;
+            }
+            
             hasPermission = infrasUser.getRoles().contains(ca.getAttribute());
             if (hasPermission) {
               log.debug("match attribute is {}", ca.getAttribute());
@@ -81,35 +109,83 @@
           }
           
           if (!hasPermission) {
-            throw new RuntimeException("no permission");
+            throw new RuntimeException("no right");
           }
           
           return exchange;
         })
         .flatMap(ex -> chain.filter(ex));
   }
-  
+
+  @Autowired
+  private AuthnService authnService;
+
   private Map<RequestMatcher, Collection<ConfigAttribute>> requestMap = new ConcurrentHashMap<RequestMatcher, Collection<ConfigAttribute>>();
 
-  @Scheduled(initialDelayString = "${sw-backend-gateway.resource.refresh-delay:10000}", fixedDelayString = "${sw-backend-gateway.resource.refresh-delay:10000}")
+  @Scheduled(
+      initialDelayString = "${sw-backend-gateway.resource.refresh-delay:200}", 
+      fixedDelayString = "${sw-backend-gateway.resource.refresh-delay:10000}")
   protected void refreshRequestMap() {
     
     log.debug("AccessControlGlobalFilter.refreshRequestMap");
     
+    requestMap.clear();
     loadRequestMap();
   }
 
   // 定时刷新 资源 与 可访问角色 的 Map
   private void loadRequestMap() {
-    requestMap.clear();
+
+    if (requestMap.isEmpty()) {
+//    AntPathRequestMatcher requestMatcher0 = new AntPathRequestMatcher("/api/**");
+//    Collection<ConfigAttribute> attributes0 = new ArrayList<ConfigAttribute>();
+//    attributes0.add(new SecurityConfig("user"));
+//    requestMap.put(requestMatcher0, attributes0);
+    
+      // 从 后端接口 加载
+      List<ResourceRoleSet> resourceRoleSets = authnService.resourceRoleSets();
+      if (resourceRoleSets != null) {
+        for (ResourceRoleSet resourceRoleSet : resourceRoleSets) {
+          String method = resourceRoleSet.getMethod();
+          String path = resourceRoleSet.getPath();
+          String access = resourceRoleSet.getAccess();
+          
+          final RequestMatcher requestMatcher = new AntPathRequestMatcher(path, method);
+          
+          Collection<ConfigAttribute> attributes = new ArrayList<ConfigAttribute>();
+          
+          if (access != null) {
+            if (access.equals(ResourceRoleSet.ACCESS_ANONYMOUS)) {
+              attributes.add(new SecurityConfig("ACCESS_"+ResourceRoleSet.ACCESS_ANONYMOUS));
+            } else if (access.equals(ResourceRoleSet.ACCESS_AUTHENTICATE)) {
+              attributes.add(new SecurityConfig("ACCESS_"+ResourceRoleSet.ACCESS_AUTHENTICATE));
+            } else if (access.equals(ResourceRoleSet.ACCESS_AUTHORIZE)) {
+              for (Role r : resourceRoleSet.getRoles()) {
+                ConfigAttribute ca = new SecurityConfig(r.getCode());
+                attributes.add(ca);
+              }
+            } else if (access.equals(ResourceRoleSet.ACCESS_PERMIT_ALL)) {
+              attributes.add(new SecurityConfig("ACCESS_"+ResourceRoleSet.ACCESS_PERMIT_ALL));
+            } else if (access.equals(ResourceRoleSet.ACCESS_DENY_ALL)) {
+              attributes.add(new SecurityConfig("ACCESS_"+ResourceRoleSet.ACCESS_DENY_ALL));
+            } else {
+              for (Role r : resourceRoleSet.getRoles()) {
+                ConfigAttribute ca = new SecurityConfig(r.getCode());
+                attributes.add(ca);
+              }
+            }
+          } else {
+            for (Role r : resourceRoleSet.getRoles()) {
+              ConfigAttribute ca = new SecurityConfig(r.getCode());
+              attributes.add(ca);
+            }
+          }
+          
+          requestMap.put(requestMatcher, attributes);
+        }
+      }
       
-    AntPathRequestMatcher requestMatcher0 = new AntPathRequestMatcher("/api/**");
-    Collection<ConfigAttribute> attributes0 = new ArrayList<ConfigAttribute>();
-    attributes0.add(new SecurityConfig("user"));
-    requestMap.put(requestMatcher0, attributes0);
-    
-    // FIXME: 从 后端接口 加载
-    
+    }
 
   }
   
diff --git a/gateway/src/main/java/com/supwisdom/institute/backend/gateway/security/core/userdetails/MyUserDetailsService.java b/gateway/src/main/java/com/supwisdom/institute/backend/gateway/security/core/userdetails/MyUserDetailsService.java
index ef7d0e2..8a30025 100644
--- a/gateway/src/main/java/com/supwisdom/institute/backend/gateway/security/core/userdetails/MyUserDetailsService.java
+++ b/gateway/src/main/java/com/supwisdom/institute/backend/gateway/security/core/userdetails/MyUserDetailsService.java
@@ -16,7 +16,7 @@
 
 import com.supwisdom.institute.backend.gateway.authn.model.Account;
 import com.supwisdom.institute.backend.gateway.authn.model.Role;
-import com.supwisdom.institute.backend.gateway.authn.service.AuthnAccountService;
+import com.supwisdom.institute.backend.gateway.authn.service.AuthnService;
 
 import reactor.core.publisher.Mono;
 import lombok.extern.slf4j.Slf4j;
@@ -28,7 +28,7 @@
   PasswordEncoder passwordEncoder;
 
   @Autowired
-  AuthnAccountService authnAccountService;
+  AuthnService authnAccountService;
   
   @Override
   public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { // TODO: 
@@ -56,7 +56,7 @@
       throw new UsernameNotFoundException(String.format("%s not found", username));
     }
     
-    List<Role> roles = authnAccountService.roles(username);
+    List<Role> roles = authnAccountService.accountRoles(username);
     
     List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
     for (Role role : roles) {
diff --git a/gateway/src/main/resources/application.yml b/gateway/src/main/resources/application.yml
index c72cbc7..1f3be47 100644
--- a/gateway/src/main/resources/application.yml
+++ b/gateway/src/main/resources/application.yml
@@ -44,7 +44,7 @@
         filters:
         - RewritePath=/api/system/(?<suffix>.*), /$\{suffix}
       - id: biz-api
-        uri: http://localhost:8082
+        uri: http://localhost:8083
         predicates:
         - Path=/api/biz/**
         filters:
@@ -72,14 +72,13 @@
 
 infras.security.jwt.public-key-pem: |-
   -----BEGIN PUBLIC KEY-----
-  MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDBQw6TmvJ+nOuRaLoHsZJGIBzRg/wbskNv6UevL3/nQioYooptPfdIHVzPiKRVT5+DW5+nqzav3DOxY+HYKjO9nFjYdj0sgvRae6iVpa5Ji1wbDKOvwIDNukgnKbqvFXX2Isfl0RxeN3uEKdjeFGGFdr38I3ADCNKFNxtbmfqvjQIDAQAB
+  MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCgzXhvHLKypr+G+gJgOJNt8Lu8ygFFCU0eO4qJ4j2vDzpGwTOWKmD/u7dwIWKyHR43hUSN+FN4SSy1AmHjEKxz0btm7Cki+0YFw0BE4/mB/0wPD251wOS3w0CLsRTfoov9OaGaXApjVSMM74aIX8D46CbwHioLHdAj0/jlVU6gZQIDAQAB
   -----END PUBLIC KEY-----
 infras.security.jwt.private-key-pem-pkcs8: |-
   -----BEGIN PRIVATE KEY-----
-  MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAMFDDpOa8n6c65FougexkkYgHNGD/BuyQ2/pR68vf+dCKhiiim0990gdXM+IpFVPn4Nbn6erNq/cM7Fj4dgqM72cWNh2PSyC9Fp7qJWlrkmLXBsMo6/AgM26SCcpuq8VdfYix+XRHF43e4Qp2N4UYYV2vfwjcAMI0oU3G1uZ+q+NAgMBAAECgYA7jA7UuhxXmMAYmJ0hO7xnMQPQJouqeP3AYK9+sfMF7WQNHR/r0vj7Vli/dUm1I4hxr+x8fAuomf+ve6gds7sm+v2JHLzEIyPPiogoC7IcBmjJ3yVzW/26cXeOmTiPC/fW2g4BpYxSM8HLDaSkrtqzy8e9ijlzMpHBvvwLikufnQJBAOXaqIPuZ7Vm/JwQHAmX2HV+Qk6GMi/H7mL8X0AaW68w+Iccdbz1hzmMBfdn5NMmx2AOwoBAVivgjt0a1OfksHMCQQDXPtXxwFy4dQ4TbPu8L38P8s/bPo9ib1YkEMp57yBw+IvxB7jnpA9rUYTfZM/HpVP7r9rfVEUylVXXzhz1qx//AkEApWJOTBdW8bQ3YEdLFS/3pJqDNSLjq3OMuBZkpqgQfh6bRAQbRynW8XYpuNk9URye6iPUmRkxp4J86ORseqoWtwJAJb5a/b1hhObhxP5DVkht23oUgLmDoxsq28AmASOxaJ3szCMyhUv7eDIfPp0K4lNXWrcHhkncqHYPS3xVD68mOQJAV4SRDdWpgAbQOUODotohE48RxrabHo0l228CJ/pnm0q7gplPs4iSNJ2eijFuOMXfKkq3z/vxiNSA59FcdoCOHQ==
+  MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBAKDNeG8csrKmv4b6AmA4k23wu7zKAUUJTR47ioniPa8POkbBM5YqYP+7t3AhYrIdHjeFRI34U3hJLLUCYeMQrHPRu2bsKSL7RgXDQETj+YH/TA8PbnXA5LfDQIuxFN+ii/05oZpcCmNVIwzvhohfwPjoJvAeKgsd0CPT+OVVTqBlAgMBAAECgYAtNxlyROOKkJCyZ4JbhA0QkOx5PWP2AZOJuLxP4SnvG50LYDAdPXVg82u1P+38n2truTF5qiXuYMUNcMoNixayWEZ074kVTI+FluLO405wwMYHvGPKOJVFIUTsKz+xkg4r48R963D5DZ6ZjoPIjLWvxL1zdrsgi9AOz/skAl0yAQJBANO0yadz1fYinSmYa2O27lgE1DpTvYBXGkY2qG7D/QJv2FwP6pdBy9ejym45UXce4wR1Yrlvh9wsErI4p790XOECQQDCcjti2nbIuZP3Dy5Ej97Y6sIbIEu5MpJW8kBjUzUssxgdE9urA/yWVzT8lmj34he+uWJv6s+e/HBDV5tc0tAFAkBK+q2s4+a0jN/SuovWPhS+Eb/EhKIKEU9Z7MPMrxctxMUBHhX8yi3SyszIKv7CTKskihqUCH86qFVaz5wBv8mhAkBgnQea13ebxnGZmSZhFKciWoq1lbdqPpFtuBJ8B5TtL9N0ZzCHaYSwYoZGVqmzONiZgF1DxIUCtuVE4JumZGzNAkB5B1sUdZfLo4q3jOiX5UQ/a4u17ptemvFPR4OynHkuVkgyAfTIo9SAB8/KIntHMlrgcP03G41ciJrYeP5zv8xm
   -----END PRIVATE KEY-----
 
-
 ##
 # infras.security cas
 #