diff --git a/src/main/java/net/sytes/kashey/sweater/config/WebSecurityConfig.java b/src/main/java/net/sytes/kashey/sweater/config/WebSecurityConfig.java
index 00f9ffd..d63cdc8 100644
--- a/src/main/java/net/sytes/kashey/sweater/config/WebSecurityConfig.java
+++ b/src/main/java/net/sytes/kashey/sweater/config/WebSecurityConfig.java
@@ -1,18 +1,16 @@
 package net.sytes.kashey.sweater.config;
 
-import net.sytes.kashey.sweater.service.CustomUserDetailsService;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configurers.LogoutConfigurer;
 import org.springframework.security.web.SecurityFilterChain;
 
-import javax.sql.DataSource;
-
 @Configuration
 @EnableWebSecurity
+@EnableMethodSecurity
 public class WebSecurityConfig {
 
     @Bean
diff --git a/src/main/java/net/sytes/kashey/sweater/controller/UserController.java b/src/main/java/net/sytes/kashey/sweater/controller/UserController.java
new file mode 100644
index 0000000..6b9adf6
--- /dev/null
+++ b/src/main/java/net/sytes/kashey/sweater/controller/UserController.java
@@ -0,0 +1,59 @@
+package net.sytes.kashey.sweater.controller;
+
+import net.sytes.kashey.sweater.domain.Role;
+import net.sytes.kashey.sweater.domain.User;
+import net.sytes.kashey.sweater.repository.UserRepository;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.annotation.*;
+
+import java.util.Arrays;
+import java.util.Map;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+@Controller
+@RequestMapping("/users")
+@PreAuthorize("hasAuthority('ADMIN')")
+public class UserController {
+
+    private final UserRepository userRepository;
+
+    public UserController(UserRepository userRepository) {
+
+        this.userRepository = userRepository;
+    }
+
+    @GetMapping
+    public String getAllUsers(Model model) {
+
+        model.addAttribute("users", userRepository.findAll());
+        return "userList";
+    }
+
+    @GetMapping("/{user}")
+    public String editUser(@PathVariable User user, Model model) {
+
+        model.addAttribute("user", user);
+        model.addAttribute("roles", Role.values());
+        return "userEdit";
+    }
+
+    @PostMapping
+    public String updateUser(@RequestParam String username,
+                             @RequestParam Map<String, String> form,
+                             @RequestParam("userId") User user) {
+
+        user.setUsername(username);
+        user.getRoles().clear();
+        Set<String> roles = Arrays.stream(Role.values()).map(Enum::name).collect(Collectors.toSet());
+        for (String role : form.keySet()) {
+            if (roles.contains(role)) {
+                user.getRoles().add(Role.valueOf(role));
+            }
+        }
+        userRepository.save(user);
+        return "redirect:/users";
+    }
+}
\ No newline at end of file
diff --git a/src/main/resources/templates/greeting.ftl b/src/main/resources/templates/greeting.ftl
index 7cb7a07..b19ebf4 100644
--- a/src/main/resources/templates/greeting.ftl
+++ b/src/main/resources/templates/greeting.ftl
@@ -1,5 +1,7 @@
 <#import "parts/common.ftl" as com>
 <@com.page>
-<div>Hello there</div>
-<a href="/main">Main page</a>
+    <div>Hello there</div>
+    <a href="/main">Main page</a>
+    <br>
+    <a href="/users">Users page</a>
 </@com.page>
\ No newline at end of file
diff --git a/src/main/resources/templates/main.ftl b/src/main/resources/templates/main.ftl
index f7754d3..42b9786 100644
--- a/src/main/resources/templates/main.ftl
+++ b/src/main/resources/templates/main.ftl
@@ -3,6 +3,7 @@
 <@com.page>
     <div>
         <@l.logout />
+        <span> <a href="/users">Users page</a> </span>
     </div>
 
     <div>
@@ -33,4 +34,5 @@
     <#else>
         No messages found
     </#list>
+    <br>
 </@com.page>
\ No newline at end of file
diff --git a/src/main/resources/templates/userEdit.ftl b/src/main/resources/templates/userEdit.ftl
new file mode 100644
index 0000000..3ed4e12
--- /dev/null
+++ b/src/main/resources/templates/userEdit.ftl
@@ -0,0 +1,14 @@
+<#import "parts/common.ftl" as com>
+<@com.page>
+    <form action="/users" method="post">
+        <input type="text" name="username" value="${user.username}">
+        <#list roles as role>
+            <div>
+                <label><input type="checkbox" name="${role}" ${user.roles?seq_contains(role)?string("checked", "")}>${role}</label>
+            </div>
+        </#list>
+        <input type="hidden" value="${user.id}" name="userId">
+        <input type="hidden" value="${_csrf.token}" name="_csrf">
+        <button type="submit">Save</button>
+    </form>
+</@com.page>
\ No newline at end of file
diff --git a/src/main/resources/templates/userList.ftl b/src/main/resources/templates/userList.ftl
new file mode 100644
index 0000000..4fd5ed1
--- /dev/null
+++ b/src/main/resources/templates/userList.ftl
@@ -0,0 +1,23 @@
+<#import "parts/common.ftl" as com>
+<@com.page>
+    <div>Users</div>
+    <table>
+        <thead>
+        <tr>
+            <th>Name</th>
+            <th>Role</th>
+            <th></th>
+        </tr>
+        </thead>
+        <tbody>
+        <#list users as user>
+            <tr>
+                <td>${user.username}</td>
+                <td><#list user.roles as role>${role}<#sep>, </#list></td>
+                <td><a href="/users/${user.id}">edit</a></td>
+            </tr>
+        </#list>
+        </tbody>
+    </table>
+    <a href="/main">Main page</a>
+</@com.page>
\ No newline at end of file