diff --git a/samples/user/src/main/java/com/supwisdom/leaveschool/user/controller/api/admin/Api1AdminGroupRoleController.java b/samples/user/src/main/java/com/supwisdom/leaveschool/user/controller/api/admin/Api1AdminGroupRoleController.java
new file mode 100644
index 0000000..bf06834
--- /dev/null
+++ b/samples/user/src/main/java/com/supwisdom/leaveschool/user/controller/api/admin/Api1AdminGroupRoleController.java
@@ -0,0 +1,67 @@
+package com.supwisdom.leaveschool.user.controller.api.admin;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.util.MimeTypeUtils;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.RestController;
+
+import com.supwisdom.leaveschool.common.model.SuccessResponseModel;
+import com.supwisdom.leaveschool.user.repository.RoleRepository;
+import com.supwisdom.leaveschool.user.repository.GroupRepository;
+import com.supwisdom.leaveschool.user.repository.GroupRoleRepository;
+
+@RestController
+@RequestMapping("/api/v1/admin/group-role")
+public class Api1AdminGroupRoleController {
+  
+  @Autowired
+  private GroupRoleRepository groupRoleRepository;
+
+  @Autowired
+  private GroupRepository groupRepository;
+
+  @Autowired
+  private RoleRepository roleRepository;
+
+  @RequestMapping(value = "/{groupId}/{roleId}", method = RequestMethod.POST, consumes = MimeTypeUtils.APPLICATION_JSON_VALUE, produces = MimeTypeUtils.APPLICATION_JSON_VALUE)
+  @ResponseBody
+  public SuccessResponseModel addGroupRole(@PathVariable("groupId") String groupId, @PathVariable("roleId") String roleId) {
+    
+    if (groupId == null || groupId.length() == 0) {
+      throw new RuntimeException("exception.get.id.must.not.empty"); // FIXME: RestException
+    }
+    if (roleId == null || roleId.length() == 0) {
+      throw new RuntimeException("exception.get.id.must.not.empty"); // FIXME: RestException
+    }
+
+    groupRoleRepository.addGroupRole(groupId, roleId);
+    
+    SuccessResponseModel res = new SuccessResponseModel();
+    res.setSuccess("info.set.success");
+
+    return res;
+  }
+
+  @RequestMapping(value = "/{groupId}/{roleId}", method = RequestMethod.DELETE, consumes = MimeTypeUtils.APPLICATION_JSON_VALUE, produces = MimeTypeUtils.APPLICATION_JSON_VALUE)
+  @ResponseBody
+  public SuccessResponseModel removeGroupRole(@PathVariable("groupId") String groupId, @PathVariable("roleId") String roleId) {
+    
+    if (groupId == null || groupId.length() == 0) {
+      throw new RuntimeException("exception.get.id.must.not.empty"); // FIXME: RestException
+    }
+    if (roleId == null || roleId.length() == 0) {
+      throw new RuntimeException("exception.get.id.must.not.empty"); // FIXME: RestException
+    }
+    
+    groupRoleRepository.removeGroupRole(groupId, roleId);
+    
+    SuccessResponseModel res = new SuccessResponseModel();
+    res.setSuccess("info.set.success");
+
+    return res;
+  }
+
+}
diff --git a/samples/user/src/main/java/com/supwisdom/leaveschool/user/controller/api/admin/Api1AdminRolePermissionController.java b/samples/user/src/main/java/com/supwisdom/leaveschool/user/controller/api/admin/Api1AdminRolePermissionController.java
new file mode 100644
index 0000000..3c3215d
--- /dev/null
+++ b/samples/user/src/main/java/com/supwisdom/leaveschool/user/controller/api/admin/Api1AdminRolePermissionController.java
@@ -0,0 +1,68 @@
+package com.supwisdom.leaveschool.user.controller.api.admin;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.util.MimeTypeUtils;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.RestController;
+
+import com.supwisdom.leaveschool.common.model.SuccessResponseModel;
+import com.supwisdom.leaveschool.user.repository.PermissionRepository;
+import com.supwisdom.leaveschool.user.repository.RolePermissionRepository;
+import com.supwisdom.leaveschool.user.repository.RoleRepository;
+
+@RestController
+@RequestMapping("/api/v1/admin/role-permission")
+public class Api1AdminRolePermissionController {
+  
+  @Autowired
+  private RolePermissionRepository groupPermissionRepository;
+
+  @Autowired
+  private RoleRepository roleRepository;
+
+  @Autowired
+  private PermissionRepository permissionRepository;
+
+
+  @RequestMapping(value = "/{roleId}/{permissionId}", method = RequestMethod.POST, consumes = MimeTypeUtils.APPLICATION_JSON_VALUE, produces = MimeTypeUtils.APPLICATION_JSON_VALUE)
+  @ResponseBody
+  public SuccessResponseModel addRolePermission(@PathVariable("roleId") String roleId, @PathVariable("permissionId") String permissionId) {
+    
+    if (roleId == null || roleId.length() == 0) {
+      throw new RuntimeException("exception.get.id.must.not.empty"); // FIXME: RestException
+    }
+    if (permissionId == null || permissionId.length() == 0) {
+      throw new RuntimeException("exception.get.id.must.not.empty"); // FIXME: RestException
+    }
+
+    groupPermissionRepository.addRolePermission(roleId, permissionId);
+    
+    SuccessResponseModel res = new SuccessResponseModel();
+    res.setSuccess("info.set.success");
+
+    return res;
+  }
+
+  @RequestMapping(value = "/{roleId}/{permissionId}", method = RequestMethod.DELETE, consumes = MimeTypeUtils.APPLICATION_JSON_VALUE, produces = MimeTypeUtils.APPLICATION_JSON_VALUE)
+  @ResponseBody
+  public SuccessResponseModel removeRolePermission(@PathVariable("roleId") String roleId, @PathVariable("permissionId") String permissionId) {
+    
+    if (roleId == null || roleId.length() == 0) {
+      throw new RuntimeException("exception.get.id.must.not.empty"); // FIXME: RestException
+    }
+    if (permissionId == null || permissionId.length() == 0) {
+      throw new RuntimeException("exception.get.id.must.not.empty"); // FIXME: RestException
+    }
+    
+    groupPermissionRepository.removeRolePermission(roleId, permissionId);
+    
+    SuccessResponseModel res = new SuccessResponseModel();
+    res.setSuccess("info.set.success");
+
+    return res;
+  }
+
+}
diff --git a/samples/user/src/main/java/com/supwisdom/leaveschool/user/controller/api/admin/Api1AdminUserGroupController.java b/samples/user/src/main/java/com/supwisdom/leaveschool/user/controller/api/admin/Api1AdminUserGroupController.java
new file mode 100644
index 0000000..9c8060f
--- /dev/null
+++ b/samples/user/src/main/java/com/supwisdom/leaveschool/user/controller/api/admin/Api1AdminUserGroupController.java
@@ -0,0 +1,67 @@
+package com.supwisdom.leaveschool.user.controller.api.admin;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.util.MimeTypeUtils;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.RestController;
+
+import com.supwisdom.leaveschool.common.model.SuccessResponseModel;
+import com.supwisdom.leaveschool.user.repository.GroupRepository;
+import com.supwisdom.leaveschool.user.repository.UserGroupRepository;
+import com.supwisdom.leaveschool.user.repository.UserRepository;
+
+@RestController
+@RequestMapping("/api/v1/admin/user-group")
+public class Api1AdminUserGroupController {
+
+  @Autowired
+  private UserGroupRepository userGroupRepository;
+
+  @Autowired
+  private UserRepository userRepository;
+
+  @Autowired
+  private GroupRepository groupRepository;
+
+  @RequestMapping(value = "/{userId}/{groupId}", method = RequestMethod.POST, consumes = MimeTypeUtils.APPLICATION_JSON_VALUE, produces = MimeTypeUtils.APPLICATION_JSON_VALUE)
+  @ResponseBody
+  public SuccessResponseModel addUserGroup(@PathVariable("userId") String userId, @PathVariable("groupId") String groupId) {
+    
+    if (userId == null || userId.length() == 0) {
+      throw new RuntimeException("exception.get.id.must.not.empty"); // FIXME: RestException
+    }
+    if (groupId == null || groupId.length() == 0) {
+      throw new RuntimeException("exception.get.id.must.not.empty"); // FIXME: RestException
+    }
+
+    userGroupRepository.addUserGroup(userId, groupId);
+    
+    SuccessResponseModel res = new SuccessResponseModel();
+    res.setSuccess("info.set.success");
+
+    return res;
+  }
+
+  @RequestMapping(value = "/{userId}/{groupId}", method = RequestMethod.DELETE, consumes = MimeTypeUtils.APPLICATION_JSON_VALUE, produces = MimeTypeUtils.APPLICATION_JSON_VALUE)
+  @ResponseBody
+  public SuccessResponseModel removeUserGroup(@PathVariable("userId") String userId, @PathVariable("groupId") String groupId) {
+    
+    if (userId == null || userId.length() == 0) {
+      throw new RuntimeException("exception.get.id.must.not.empty"); // FIXME: RestException
+    }
+    if (groupId == null || groupId.length() == 0) {
+      throw new RuntimeException("exception.get.id.must.not.empty"); // FIXME: RestException
+    }
+
+    userGroupRepository.removeUserGroup(userId, groupId);
+    
+    SuccessResponseModel res = new SuccessResponseModel();
+    res.setSuccess("info.set.success");
+
+    return res;
+  }
+
+}
diff --git a/samples/user/src/main/java/com/supwisdom/leaveschool/user/controller/api/admin/Api1AdminUserRoleController.java b/samples/user/src/main/java/com/supwisdom/leaveschool/user/controller/api/admin/Api1AdminUserRoleController.java
new file mode 100644
index 0000000..f8c7218
--- /dev/null
+++ b/samples/user/src/main/java/com/supwisdom/leaveschool/user/controller/api/admin/Api1AdminUserRoleController.java
@@ -0,0 +1,67 @@
+package com.supwisdom.leaveschool.user.controller.api.admin;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.util.MimeTypeUtils;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.RestController;
+
+import com.supwisdom.leaveschool.common.model.SuccessResponseModel;
+import com.supwisdom.leaveschool.user.repository.RoleRepository;
+import com.supwisdom.leaveschool.user.repository.UserRepository;
+import com.supwisdom.leaveschool.user.repository.UserRoleRepository;
+
+@RestController
+@RequestMapping("/api/v1/admin/user-role")
+public class Api1AdminUserRoleController {
+  
+  @Autowired
+  private UserRoleRepository userRoleRepository;
+
+  @Autowired
+  private UserRepository userRepository;
+
+  @Autowired
+  private RoleRepository roleRepository;
+
+  @RequestMapping(value = "/{userId}/{roleId}", method = RequestMethod.POST, consumes = MimeTypeUtils.APPLICATION_JSON_VALUE, produces = MimeTypeUtils.APPLICATION_JSON_VALUE)
+  @ResponseBody
+  public SuccessResponseModel addUserRole(@PathVariable("userId") String userId, @PathVariable("roleId") String roleId) {
+    
+    if (userId == null || userId.length() == 0) {
+      throw new RuntimeException("exception.get.id.must.not.empty"); // FIXME: RestException
+    }
+    if (roleId == null || roleId.length() == 0) {
+      throw new RuntimeException("exception.get.id.must.not.empty"); // FIXME: RestException
+    }
+
+    userRoleRepository.addUserRole(userId, roleId);
+    
+    SuccessResponseModel res = new SuccessResponseModel();
+    res.setSuccess("info.set.success");
+
+    return res;
+  }
+
+  @RequestMapping(value = "/{userId}/{roleId}", method = RequestMethod.DELETE, consumes = MimeTypeUtils.APPLICATION_JSON_VALUE, produces = MimeTypeUtils.APPLICATION_JSON_VALUE)
+  @ResponseBody
+  public SuccessResponseModel removeUserRole(@PathVariable("userId") String userId, @PathVariable("roleId") String roleId) {
+    
+    if (userId == null || userId.length() == 0) {
+      throw new RuntimeException("exception.get.id.must.not.empty"); // FIXME: RestException
+    }
+    if (roleId == null || roleId.length() == 0) {
+      throw new RuntimeException("exception.get.id.must.not.empty"); // FIXME: RestException
+    }
+    
+    userRoleRepository.removeUserRole(userId, roleId);
+    
+    SuccessResponseModel res = new SuccessResponseModel();
+    res.setSuccess("info.set.success");
+
+    return res;
+  }
+
+}
diff --git a/samples/user/src/main/java/com/supwisdom/leaveschool/user/repository/GroupRoleRepository.java b/samples/user/src/main/java/com/supwisdom/leaveschool/user/repository/GroupRoleRepository.java
index 253f4fe..ee98114 100644
--- a/samples/user/src/main/java/com/supwisdom/leaveschool/user/repository/GroupRoleRepository.java
+++ b/samples/user/src/main/java/com/supwisdom/leaveschool/user/repository/GroupRoleRepository.java
@@ -3,6 +3,7 @@
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 
 import org.springframework.data.domain.Example;
 import org.springframework.data.domain.ExampleMatcher;
@@ -146,4 +147,45 @@
     return groupRoles;
   }
 
+  public default GroupRole selectOneByGroupRole(String groupId, String roleId) {
+
+    GroupRole probe = new GroupRole();
+    probe.setGroupId(groupId);
+    probe.setRoleId(roleId);
+
+    ExampleMatcher matcher = ExampleMatcher.matching()
+        .withMatcher("groupId", ExampleMatcher.GenericPropertyMatchers.exact())
+        .withMatcher("roleId", ExampleMatcher.GenericPropertyMatchers.exact())
+        ;
+
+    Example<GroupRole> example = Example.of(probe, matcher);
+    
+    Optional<GroupRole> o = this.findOne(example);
+    
+    return o.isPresent() ? o.get() : null;
+  }
+
+  public default void addGroupRole(String groupId, String roleId) {
+
+    GroupRole groupRole = this.selectOneByGroupRole(groupId, roleId);
+    
+    if (groupRole == null) {
+      groupRole = new GroupRole();
+      //groupRole.setCompanyId(companyId);
+      groupRole.setGroupId(groupId);
+      groupRole.setRoleId(roleId);
+      
+      this.insert(groupRole);
+    }
+  }
+
+  public default void removeGroupRole(String groupId, String roleId) {
+
+    GroupRole groupRole = this.selectOneByGroupRole(groupId, roleId);
+    
+    if (groupRole != null) {
+      this.deleteById(groupRole.getId());
+    }
+  }
+
 }
diff --git a/samples/user/src/main/java/com/supwisdom/leaveschool/user/repository/RolePermissionRepository.java b/samples/user/src/main/java/com/supwisdom/leaveschool/user/repository/RolePermissionRepository.java
index 6dc9f2d..4ace464 100644
--- a/samples/user/src/main/java/com/supwisdom/leaveschool/user/repository/RolePermissionRepository.java
+++ b/samples/user/src/main/java/com/supwisdom/leaveschool/user/repository/RolePermissionRepository.java
@@ -3,6 +3,7 @@
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 
 import org.springframework.data.domain.Example;
 import org.springframework.data.domain.ExampleMatcher;
@@ -148,4 +149,45 @@
     return rolePermissions;
   }
 
+  public default RolePermission selectOneByRolePermission(String roleId, String permissionId) {
+
+    RolePermission probe = new RolePermission();
+    probe.setRoleId(roleId);
+    probe.setPermissionId(permissionId);
+
+    ExampleMatcher matcher = ExampleMatcher.matching()
+        .withMatcher("roleId", ExampleMatcher.GenericPropertyMatchers.exact())
+        .withMatcher("permissionId", ExampleMatcher.GenericPropertyMatchers.exact())
+        ;
+
+    Example<RolePermission> example = Example.of(probe, matcher);
+    
+    Optional<RolePermission> o = this.findOne(example);
+    
+    return o.isPresent() ? o.get() : null;
+  }
+
+  public default void addRolePermission(String roleId, String permissionId) {
+
+    RolePermission rolePermission = this.selectOneByRolePermission(roleId, permissionId);
+    
+    if (rolePermission == null) {
+      rolePermission = new RolePermission();
+      //rolePermission.setCompanyId(companyId);
+      rolePermission.setRoleId(roleId);
+      rolePermission.setPermissionId(permissionId);
+      
+      this.insert(rolePermission);
+    }
+  }
+
+  public default void removeRolePermission(String roleId, String permissionId) {
+
+    RolePermission rolePermission = this.selectOneByRolePermission(roleId, permissionId);
+    
+    if (rolePermission != null) {
+      this.deleteById(rolePermission.getId());
+    }
+  }
+
 }
diff --git a/samples/user/src/main/java/com/supwisdom/leaveschool/user/repository/UserGroupRepository.java b/samples/user/src/main/java/com/supwisdom/leaveschool/user/repository/UserGroupRepository.java
index 04f26d0..4ce86fc 100644
--- a/samples/user/src/main/java/com/supwisdom/leaveschool/user/repository/UserGroupRepository.java
+++ b/samples/user/src/main/java/com/supwisdom/leaveschool/user/repository/UserGroupRepository.java
@@ -3,6 +3,7 @@
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 
 import org.springframework.data.domain.Example;
 import org.springframework.data.domain.ExampleMatcher;
@@ -55,12 +56,11 @@
 
     PageRequest pageRequest = PageRequest.of(pageIndex, pageSize);
 
-    Page<UserGroup> page = this.findAll(example, pageRequest);  // FIXME: 多表关联查询
+    Page<UserGroup> page = this.findAll(example, pageRequest); // FIXME: 多表关联查询
 
     return page;
   }
 
-
   public default void relateUserGroups(User user, List<UserGroup> userGroups) {
 
     List<UserGroup> existUserGroups = this.selectListByUserId(user.getId());
@@ -94,8 +94,8 @@
     UserGroup probe = new UserGroup();
     probe.setUserId(userId);
 
-    ExampleMatcher matcher = ExampleMatcher.matching()
-        .withMatcher("userId", ExampleMatcher.GenericPropertyMatchers.exact());
+    ExampleMatcher matcher = ExampleMatcher.matching().withMatcher("userId",
+        ExampleMatcher.GenericPropertyMatchers.exact());
 
     Example<UserGroup> example = Example.of(probe, matcher);
 
@@ -104,7 +104,6 @@
     return userGroups;
   }
 
-  
   public default void relateGroupUsers(Group group, List<UserGroup> userGroups) {
 
     List<UserGroup> existGroupUsers = this.selectListByGroupId(group.getId());
@@ -147,5 +146,46 @@
 
     return userGroups;
   }
+  
+  public default UserGroup selectOneByUserGroup(String userId, String groupId) {
+
+    UserGroup probe = new UserGroup();
+    probe.setUserId(userId);
+    probe.setGroupId(groupId);
+
+    ExampleMatcher matcher = ExampleMatcher.matching()
+        .withMatcher("userId", ExampleMatcher.GenericPropertyMatchers.exact())
+        .withMatcher("groupId", ExampleMatcher.GenericPropertyMatchers.exact())
+        ;
+
+    Example<UserGroup> example = Example.of(probe, matcher);
+    
+    Optional<UserGroup> o = this.findOne(example);
+    
+    return o.isPresent() ? o.get() : null;
+  }
+
+  public default void addUserGroup(String userId, String groupId) {
+    
+    UserGroup userGroup = this.selectOneByUserGroup(userId, groupId);
+    
+    if (userGroup == null) {
+      userGroup = new UserGroup();
+      //userGroup.setCompanyId(companyId);
+      userGroup.setUserId(userId);
+      userGroup.setGroupId(groupId);
+      
+      this.insert(userGroup);
+    }
+  }
+
+  public default void removeUserGroup(String userId, String groupId) {
+    
+    UserGroup userGroup = this.selectOneByUserGroup(userId, groupId);
+    
+    if (userGroup != null) {
+      this.deleteById(userGroup.getId());
+    }
+  }
 
 }
diff --git a/samples/user/src/main/java/com/supwisdom/leaveschool/user/repository/UserRoleRepository.java b/samples/user/src/main/java/com/supwisdom/leaveschool/user/repository/UserRoleRepository.java
index 995da11..57adced 100644
--- a/samples/user/src/main/java/com/supwisdom/leaveschool/user/repository/UserRoleRepository.java
+++ b/samples/user/src/main/java/com/supwisdom/leaveschool/user/repository/UserRoleRepository.java
@@ -3,6 +3,7 @@
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 
 import org.springframework.data.domain.Example;
 import org.springframework.data.domain.ExampleMatcher;
@@ -93,8 +94,8 @@
     UserRole probe = new UserRole();
     probe.setUserId(userId);
 
-    ExampleMatcher matcher = ExampleMatcher.matching()
-        .withMatcher("userId", ExampleMatcher.GenericPropertyMatchers.exact());
+    ExampleMatcher matcher = ExampleMatcher.matching().withMatcher("userId",
+        ExampleMatcher.GenericPropertyMatchers.exact());
 
     Example<UserRole> example = Example.of(probe, matcher);
 
@@ -103,7 +104,6 @@
     return userRoles;
   }
 
-  
   public default void relateRoleUsers(Role role, List<UserRole> userRoles) {
 
     List<UserRole> existRoleUsers = this.selectListByRoleId(role.getId());
@@ -137,8 +137,8 @@
     UserRole probe = new UserRole();
     probe.setRoleId(roleId);
 
-    ExampleMatcher matcher = ExampleMatcher.matching()
-        .withMatcher("roleId", ExampleMatcher.GenericPropertyMatchers.exact());
+    ExampleMatcher matcher = ExampleMatcher.matching().withMatcher("roleId",
+        ExampleMatcher.GenericPropertyMatchers.exact());
 
     Example<UserRole> example = Example.of(probe, matcher);
 
@@ -146,5 +146,46 @@
 
     return userRoles;
   }
+  
+  public default UserRole selectOneByUserRole(String userId, String roleId) {
+
+    UserRole probe = new UserRole();
+    probe.setUserId(userId);
+    probe.setRoleId(roleId);
+
+    ExampleMatcher matcher = ExampleMatcher.matching()
+        .withMatcher("userId", ExampleMatcher.GenericPropertyMatchers.exact())
+        .withMatcher("roleId", ExampleMatcher.GenericPropertyMatchers.exact())
+        ;
+
+    Example<UserRole> example = Example.of(probe, matcher);
+    
+    Optional<UserRole> o = this.findOne(example);
+    
+    return o.isPresent() ? o.get() : null;
+  }
+
+  public default void addUserRole(String userId, String roleId) {
+
+    UserRole userRole = this.selectOneByUserRole(userId, roleId);
+    
+    if (userRole == null) {
+      userRole = new UserRole();
+      //userRole.setCompanyId(companyId);
+      userRole.setUserId(userId);
+      userRole.setRoleId(roleId);
+      
+      this.insert(userRole);
+    }
+  }
+
+  public default void removeUserRole(String userId, String roleId) {
+
+    UserRole userRole = this.selectOneByUserRole(userId, roleId);
+    
+    if (userRole != null) {
+      this.deleteById(userRole.getId());
+    }
+  }
 
 }