diff --git a/samples/user/pom.xml b/samples/user/pom.xml
index 23bbb2e..33eb022 100644
--- a/samples/user/pom.xml
+++ b/samples/user/pom.xml
@@ -53,6 +53,11 @@
 
     <dependency>
       <groupId>com.supwisdom.infras</groupId>
+      <artifactId>infras-security</artifactId>
+    </dependency>
+
+    <dependency>
+      <groupId>com.supwisdom.infras</groupId>
       <artifactId>infras-mvc</artifactId>
     </dependency>
 
diff --git a/samples/user/src/main/java/com/supwisdom/leaveschool/user/controller/api/admin/Api1AdminUserController.java b/samples/user/src/main/java/com/supwisdom/leaveschool/user/controller/api/admin/Api1AdminUserController.java
index 474e9c5..f17a8cd 100644
--- a/samples/user/src/main/java/com/supwisdom/leaveschool/user/controller/api/admin/Api1AdminUserController.java
+++ b/samples/user/src/main/java/com/supwisdom/leaveschool/user/controller/api/admin/Api1AdminUserController.java
@@ -34,10 +34,10 @@
   
   /**
    * 
-   * curl -i -s -X GET -H 'Accept:application/json' 'http://localhost:10010/api/v1/admin/users' 
-   * curl -i -s -X GET -H 'Accept:application/json' 'http://localhost:10010/api/v1/admin/users?pageIndex=2&pageSize=50' 
-   * curl -i -s -X GET -H 'Accept:application/json' 'http://localhost:10010/api/v1/admin/users?pageIndex=0&pageSize=20&mapBean[username]=username&mapBean[name]=name&mapBean[status]=1' 
-   * curl -i -s -X GET -H 'Accept:application/json' 'http://localhost:10010/api/v1/admin/users?pageIndex=0&pageSize=20&mapBean[username]=username&mapBean[name]=name&mapBean[status]=0' 
+   * curl -i -s -X GET -H 'Authorization:Basic YWRtaW46cGFzc3dvcmQ=' -H 'Accept:application/json' 'http://localhost:10010/api/v1/admin/users' 
+   * curl -i -s -X GET -H 'Authorization:Basic YWRtaW46cGFzc3dvcmQ=' -H 'Accept:application/json' 'http://localhost:10010/api/v1/admin/users?pageIndex=2&pageSize=50' 
+   * curl -i -s -X GET -H 'Authorization:Basic YWRtaW46cGFzc3dvcmQ=' -H 'Accept:application/json' 'http://localhost:10010/api/v1/admin/users?pageIndex=0&pageSize=20&mapBean[username]=username&mapBean[name]=name&mapBean[status]=1' 
+   * curl -i -s -X GET -H 'Authorization:Basic YWRtaW46cGFzc3dvcmQ=' -H 'Accept:application/json' 'http://localhost:10010/api/v1/admin/users?pageIndex=0&pageSize=20&mapBean[username]=username&mapBean[name]=name&mapBean[status]=0' 
    * 
    * response success: 
    * 
@@ -69,6 +69,16 @@
    *   ]
    * }
    * 
+   * response error 401:
+   * 
+   * {
+   *   "timestamp":"2018-08-03T08:48:25.777+0000",
+   *   "status":401,
+   *   "error":"Http Status 401",
+   *   "message":"Unauthorized",
+   *   "path":"/api/v1/admin/users"
+   * }
+   * 
    * @param pagerRequestModel
    * @return
    */
@@ -89,7 +99,7 @@
   
   /**
    * 
-   * curl -i -s -X GET -H 'Accept:application/json' 'http://localhost:10010/api/v1/admin/users/1' 
+   * curl -i -s -X GET -H 'Authorization:Basic YWRtaW46cGFzc3dvcmQ=' -H 'Accept:application/json' 'http://localhost:10010/api/v1/admin/users/1' 
    * 
    * response success: 
    * 
@@ -112,7 +122,17 @@
    *   "email":null
    * }
    * 
-   * response error:
+   * response error 401:
+   * 
+   * {
+   *   "timestamp":"2018-08-03T08:43:26.080+0000",
+   *   "status":401,
+   *   "error":"Http Status 401",
+   *   "message":"Unauthorized",
+   *   "path":"/api/v1/admin/users/ff80808164fecf640164fed269480000"
+   * }
+   * 
+   * response error 500:
    * 
    * {
    *   "timestamp":"2018-08-03T07:44:07.963+0000",
@@ -146,7 +166,7 @@
   
   /**
    * 
-   * curl -i -s -X POST -H 'Content-Type:application/json' -H 'Accept:application/json' 'http://localhost:10010/api/v1/admin/users' \
+   * curl -i -s -X POST -H 'Authorization:Basic YWRtaW46cGFzc3dvcmQ=' -H 'Content-Type:application/json' -H 'Accept:application/json' 'http://localhost:10010/api/v1/admin/users' \
    * -d '{"username":"test001","password":"test001","enabled":true,"accountNonExpired":true,"accountNonLocked":true,"credentialsNonExpired":true,"name":"测试001","status":"1"}'
    * 
    * response success: 
@@ -155,6 +175,16 @@
    *   "success":"info.save.success"
    * }
    * 
+   * response error 401:
+   * 
+   * {
+   *   "timestamp":"2018-08-03T08:48:25.777+0000",
+   *   "status":401,
+   *   "error":"Http Status 401",
+   *   "message":"Unauthorized",
+   *   "path":"/api/v1/admin/users"
+   * }
+   * 
    * response error: // FIXME: save error
    * 
    * {
@@ -184,7 +214,7 @@
   
   /**
    * 
-   * curl -i -s -X PUT -H 'Content-Type:application/json' -H 'Accept:application/json' 'http://localhost:10010/api/v1/admin/users' \
+   * curl -i -s -X PUT -H 'Authorization:Basic YWRtaW46cGFzc3dvcmQ=' -H 'Content-Type:application/json' -H 'Accept:application/json' 'http://localhost:10010/api/v1/admin/users' \
    * -d '{"id":"1","status":"0"}'
    * 
    * response success:
@@ -193,7 +223,17 @@
    *   "success":"info.update.success"
    * }
    * 
-   * curl -i -s -X PUT -H 'Content-Type:application/json' -H 'Accept:application/json' 'http://localhost:10010/api/v1/admin/users' \
+   * response error 401:
+   * 
+   * {
+   *   "timestamp":"2018-08-03T08:48:25.777+0000",
+   *   "status":401,
+   *   "error":"Http Status 401",
+   *   "message":"Unauthorized",
+   *   "path":"/api/v1/admin/users"
+   * }
+   * 
+   * curl -i -s -X PUT -H 'Authorization:Basic YWRtaW46cGFzc3dvcmQ=' -H 'Content-Type:application/json' -H 'Accept:application/json' 'http://localhost:10010/api/v1/admin/users' \
    * -d '{"status":"0"}'
    * 
    * response error:
@@ -207,7 +247,7 @@
    *   "path":"/api/v1/admin/users"
    * }
    * 
-   * curl -i -s -X PUT -H 'Content-Type:application/json' -H 'Accept:application/json' 'http://localhost:10010/api/v1/admin/users' \
+   * curl -i -s -X PUT -H 'Authorization:Basic YWRtaW46cGFzc3dvcmQ=' -H 'Content-Type:application/json' -H 'Accept:application/json' 'http://localhost:10010/api/v1/admin/users' \
    * -d '{"id":"1","status":"0"}'
    * 
    * response error:
@@ -251,7 +291,7 @@
   
   /**
    * 
-   * curl -i -s -X DELETE -H 'Accept:application/json' 'http://localhost:10010/api/v1/admin/users/1'
+   * curl -i -s -X DELETE -H 'Authorization:Basic YWRtaW46cGFzc3dvcmQ=' -H 'Accept:application/json' 'http://localhost:10010/api/v1/admin/users/1'
    * 
    * response success: 
    * 
@@ -259,7 +299,17 @@
    *   "success":"info.delete.success"
    * }
    * 
-   * response error: 
+   * response error 401:
+   * 
+   * {
+   *   "timestamp":"2018-08-03T08:48:25.777+0000",
+   *   "status":401,
+   *   "error":"Http Status 401",
+   *   "message":"Unauthorized",
+   *   "path":"/api/v1/admin/users/1"
+   * }
+   * 
+   * response error 500: 
    * 
    * {
    *   "timestamp":"2018-08-03T08:03:16.364+0000",
diff --git a/samples/user/src/main/java/com/supwisdom/leaveschool/user/util/AuthenticationUtil.java b/samples/user/src/main/java/com/supwisdom/leaveschool/user/util/AuthenticationUtil.java
index b98e3cb..24368cb 100644
--- a/samples/user/src/main/java/com/supwisdom/leaveschool/user/util/AuthenticationUtil.java
+++ b/samples/user/src/main/java/com/supwisdom/leaveschool/user/util/AuthenticationUtil.java
@@ -2,6 +2,8 @@
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
 
 public class AuthenticationUtil {
 
@@ -9,10 +11,27 @@
 
   public static String currentUsername() {
     
-    logger.warn("FIXME: currentUsername. return 'user' by default.");
-    return "user";  // FIXME: currentUsername
-
     /*
+    if (RequestContextHolder.getRequestAttributes() != null) {
+      ServletRequestAttributes servletRequestAttributes = (ServletRequestAttributes)RequestContextHolder.getRequestAttributes();
+      if (servletRequestAttributes != null) {
+        HttpServletRequest httpServletRequest = servletRequestAttributes.getRequest();
+        if (httpServletRequest != null) {
+          String remoteUser = httpServletRequest.getRemoteUser();
+          logger.debug("httpServletRequest.getRemoteUser(): ", remoteUser);
+          
+          if (remoteUser != null) {
+            return remoteUser;
+          }
+        }
+      }
+    }
+    */
+    
+    //logger.warn("FIXME: currentUsername. return 'user' by default.");
+    //return "user";  // FIXME: currentUsername
+    //throw new RuntimeException("exception.authentication.remote.user.must.not.empty");
+
     Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
 
     if (authentication == null) {
@@ -34,12 +53,15 @@
 
     logger.debug("authentication's principal is {}", authentication.getPrincipal());
 
-    if (authentication.getPrincipal() instanceof MyUser) {
-      return ((MyUser) authentication.getPrincipal()).getUsername();
+    //if (authentication.getPrincipal() instanceof MyUser) {
+    //  return ((MyUser) authentication.getPrincipal()).getUsername();
+    //}
+    if (authentication.getPrincipal() instanceof String) {
+      return String.valueOf(authentication.getPrincipal());
     }
+    
 
     return null;
-    */
   }
 
 }