diff --git a/auth/admin.go b/auth/admin.go
index 1ff8d31..30ae547 100644
--- a/auth/admin.go
+++ b/auth/admin.go
@@ -2,6 +2,7 @@ package auth
 
 import (
 	"fmt"
+	"time"
 
 	log "github.com/Sirupsen/logrus"
 	uuid "github.com/archsh/go.uuid"
@@ -168,10 +169,145 @@ func AddUser(session *xql.Session, name, password, email string, activate bool,
 	return user.Id, nil
 }
 
-func ModGroup(session *xql.Session, group string, opts ...string) error {
+func ModGroupProps(session *xql.Session, group string, params map[string]interface{}) error {
+	if len(params) < 1 {
+		return nil
+	}
+	now := time.Now()
+	var groupId string
+	params["updated"] = &now
+	if uid, e := uuid.FromString(group); nil != e {
+		if s, e := GetGroup(session, group); nil != e {
+			return e
+		} else {
+			groupId = s
+		}
+	} else {
+		groupId = uid.String()
+	}
+	if _, e := session.Table(groupTable).Where("id", groupId).Update(params); nil != e {
+		return e
+	} else {
+		return nil
+	}
 	return fmt.Errorf("not implemented")
 }
 
-func ModUser(session *xql.Session, user string, opts ...string) error {
+func ModGroupPermissions(session *xql.Session, group string, remove bool, roles ...string) error {
+	if len(roles) < 1 {
+		return nil
+	}
+	var groupId string
+	if uid, e := uuid.FromString(group); nil != e {
+		if s, e := GetGroup(session, group); nil != e {
+			return e
+		} else {
+			groupId = s
+		}
+	} else {
+		groupId = uid.String()
+	}
+	if remove {
+		if _, e := session.Table(groupPermissionTable).Where("group_id", groupId).Where("role", postgres.StringArray(roles), "=", "ANY").Delete(); nil != e {
+			return e
+		} else {
+			return nil
+		}
+	} else {
+		now := time.Now()
+		for _, role := range roles {
+			if n, e := session.Table(groupPermissionTable).Where("group_id", groupId).Where("role", role).Count(); nil != e {
+				return e
+			} else if n > 0 {
+				continue
+			} else if _, e := session.Table(groupPermissionTable).Insert(&GroupPermission{
+				GroupId: groupId,
+				Role:    role,
+				Created: &now,
+				Updated: &now,
+			}); nil != e {
+				return e
+			}
+		}
+		return nil
+	}
+	return fmt.Errorf("not implemented")
+}
+
+func ModUserProps(session *xql.Session, user string, params map[string]interface{}) error {
+	if len(params) < 1 {
+		return nil
+	}
+	now := time.Now()
+	var userId string
+	if uid, e := uuid.FromString(user); nil != e {
+		if s, e := GetUserIdByName(session, user); nil != e {
+			return e
+		} else {
+			userId = s
+		}
+	} else {
+		userId = uid.String()
+	}
+	params["updated"] = &now
+	if _, e := session.Table(userTable).Where("id", userId).Update(params); nil != e {
+		return e
+	} else {
+		return nil
+	}
+	return fmt.Errorf("not implemented")
+}
+
+func ModUserGroups(session *xql.Session, user string, remove bool, groups ...string) error {
+	if len(groups) < 1 {
+		return nil
+	}
+	var userId string
+	if uid, e := uuid.FromString(user); nil != e {
+		if s, e := GetUserIdByName(session, user); nil != e {
+			return e
+		} else {
+			userId = s
+		}
+	} else {
+		userId = uid.String()
+	}
+	var groupIds []string
+	for _, g := range groups {
+		if uid, e := uuid.FromString(g); nil != e {
+			if groupId, e := GetGroup(session, g); nil != e {
+				return e
+			} else {
+				groupIds = append(groupIds, groupId)
+			}
+		} else {
+			groupIds = append(groupIds, uid.String())
+		}
+	}
+	if remove {
+		if _, e := session.Table(groupUserTable).Where("user_id", userId).Where("group_id", postgres.StringArray(groupIds), "=", "ANY").Delete(); nil != e {
+			return e
+		} else {
+			return nil
+		}
+	} else {
+		now := time.Now()
+		for _, groupId := range groupIds {
+
+			if n, e := session.Table(groupUserTable).Where("user_id", userId).Where("group_id", groupId).Count(); nil != e {
+				return e
+			} else if n > 0 {
+				continue
+			} else if _, e := session.Table(groupUserTable).Insert(&GroupUser{
+				GroupId: groupId,
+				UserId:  userId,
+				Created: &now,
+				Updated: &now,
+			}); nil != e {
+				return e
+			}
+		}
+		return nil
+	}
 	return fmt.Errorf("not implemented")
 }
diff --git a/auth/cmd.go b/auth/cmd.go
index f0fd61a..8b0440a 100644
--- a/auth/cmd.go
+++ b/auth/cmd.go
@@ -10,6 +10,7 @@ import (
 	"github.com/spf13/viper"
 
 	"cygnux.net/kepler/config"
+	"cygnux.net/kepler/misc"
 	"cygnux.net/kepler/restlet"
 )
 
@@ -160,20 +161,139 @@ var delUserCmd = &cobra.Command{
 	},
 }
 
+var modUserCmd = &cobra.Command{
+	Use:   "mod_user",
+	Short: "Modify User",
+	Run: func(cmd *cobra.Command, args []string) {
+		//name, _ := cmd.Flags().GetString("name")
+		//validateEmptyString(name, "name")
+		var updateMap = make(map[string]interface{})
+		remove, _ := cmd.Flags().GetBool("remove")
+		password, _ := cmd.Flags().GetString("password")
+		if password != "" {
+			updateMap["password"] = misc.MD5Hash(password)
+		}
+		email, _ := cmd.Flags().GetString("email")
+		if email != "" {
+			updateMap["email"] = email
+		}
+		groups, _ := cmd.Flags().GetStringArray("groups")
+		if len(args) < 1 {
+			return
+		}
+		log.SetFormatter(&log.TextFormatter{})
+		cfg := config.MakeVConfig(viper.GetViper())
+		ctx, e := restlet.NewDummyContext(cfg)
+		if nil != e {
+			log.Errorln("> Setup Context failed:>", e)
+			os.Exit(1)
+		}
+		session := xql.MakeSession(ctx.SQL(), "postgres", true)
+		defer session.Close()
+		if e := session.Begin(); nil != e {
+			log.Errorln("> Session begin failed:>", e)
+			os.Exit(1)
+		}
+		if len(updateMap) > 0 {
+			for _, arg := range args {
+				if e := ModUserProps(session, arg, updateMap); nil != e {
+					die("ModUserProps failed:", e)
+				}
+			}
+		}
+		if len(groups) > 0 {
+			for _, arg := range args {
+				if e := ModUserGroups(session, arg, remove, groups...); nil != e {
+					die("ModUserGroups failed:", e)
+				}
+			}
+		}
+		if e := session.Commit(); nil != e {
+			_ = session.Rollback()
+			log.Errorln("> Session commit failed:>", e)
+			os.Exit(1)
+		}
+	},
+}
+
+var modGroupCmd = &cobra.Command{
+	Use:   "mod_group",
+	Short: "Modify Group",
+	Run: func(cmd *cobra.Command, args []string) {
+		desc, _ := cmd.Flags().GetString("desc")
+		//validateEmptyString(name, "name")
+		var updateMap = make(map[string]interface{})
+		remove, _ := cmd.Flags().GetBool("remove")
+		roles, _ := cmd.Flags().GetStringArray("roles")
+		if len(args) < 1 {
+			return
+		}
+		if desc != "" {
+			updateMap["desc"] = desc
+		}
+		log.SetFormatter(&log.TextFormatter{})
+		cfg := config.MakeVConfig(viper.GetViper())
+		ctx, e := restlet.NewDummyContext(cfg)
+		if nil != e {
+			log.Errorln("> Setup Context failed:>", e)
+			os.Exit(1)
+		}
+		session := xql.MakeSession(ctx.SQL(), "postgres", true)
+		defer session.Close()
+		if e := session.Begin(); nil != e {
+			log.Errorln("> Session begin failed:>", e)
+			os.Exit(1)
+		}
+		if len(updateMap) > 0 {
+			for _, arg := range args {
+				if e := ModGroupProps(session, arg, updateMap); nil != e {
+					die("ModGroupProps failed:", e)
+				}
+			}
+		}
+		if len(roles) > 0 {
+			for _, arg := range args {
+				if e := ModGroupPermissions(session, arg, remove, roles...); nil != e {
+					die("ModGroupPermissions failed:", e)
+				}
+			}
+		}
+		if e := session.Commit(); nil != e {
+			_ = session.Rollback()
+			log.Errorln("> Session commit failed:>", e)
+			os.Exit(1)
+		}
+	},
+}
+
 var Command = &cobra.Command{
 	Use:   "auth",
 	Short: "User & Group managements",
 }
 
+func die(a ...interface{}) {
+	fmt.Println(a...)
+	os.Exit(1)
+}
 func init() {
-	Command.AddCommand(addGroupCmd, addUserCmd, delGroupCmd, delUserCmd)
 
 	addGroupCmd.Flags().StringP("name", "N", "", "Name of Group")
 	addGroupCmd.Flags().StringP("desc", "C", "", "Comment of Group")
 	addGroupCmd.Flags().StringArrayP("roles", "R", nil, "Roles of Group")
 
+	modGroupCmd.Flags().StringP("desc", "C", "", "Comment of Group")
+	modGroupCmd.Flags().StringArrayP("roles", "R", nil, "Roles of Group")
+	modGroupCmd.Flags().Bool("remove", false, "Remove roles")
+
 	addUserCmd.Flags().StringP("name", "N", "", "Name of User")
 	addUserCmd.Flags().StringP("password", "P", "", "Password of User")
 	addUserCmd.Flags().StringP("email", "M", "", "Email of User")
 	addUserCmd.Flags().StringArrayP("groups", "G", nil, "Groups of User")
+
+	modUserCmd.Flags().StringP("password", "P", "", "Password of User")
+	modUserCmd.Flags().StringP("email", "M", "", "Email of User")
+	modUserCmd.Flags().StringArrayP("groups", "G", nil, "Groups of User")
+	modUserCmd.Flags().Bool("remove", false, "Remove from groups")
+
+	Command.AddCommand(addGroupCmd, addUserCmd, delGroupCmd, delUserCmd, modUserCmd, modGroupCmd)
 }
diff --git a/demo1/cmd/root.go b/demo1/cmd/root.go
index 91c9dd9..c0df788 100644
--- a/demo1/cmd/root.go
+++ b/demo1/cmd/root.go
@@ -20,6 +20,8 @@ import (
 
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
+
+	"cygnux.net/kepler/auth"
 )
 
 var cfgFile string
@@ -61,7 +63,7 @@ func init() {
 	//rootCmd.Flags().BoolP("toggle", "t", false, "Help message for toggle")
 	rootCmd.PersistentFlags().BoolP("verbose", "V", false, "Toggle verbose messages")
 	rootCmd.PersistentFlags().BoolP("debug", "D", false, "Toggle debug flag")
-	//rootCmd.AddCommand(get.RootCmd)
+	rootCmd.AddCommand(auth.Command)
 }
 
 // initConfig reads in config file and ENV variables if set.
diff --git a/demo2/cmd/root.go b/demo2/cmd/root.go
index 91c9dd9..c0df788 100644
--- a/demo2/cmd/root.go
+++ b/demo2/cmd/root.go
@@ -20,6 +20,8 @@ import (
 
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
+
+	"cygnux.net/kepler/auth"
 )
 
 var cfgFile string
@@ -61,7 +63,7 @@ func init() {
 	//rootCmd.Flags().BoolP("toggle", "t", false, "Help message for toggle")
 	rootCmd.PersistentFlags().BoolP("verbose", "V", false, "Toggle verbose messages")
 	rootCmd.PersistentFlags().BoolP("debug", "D", false, "Toggle debug flag")
-	//rootCmd.AddCommand(get.RootCmd)
+	rootCmd.AddCommand(auth.Command)
 }
 
 // initConfig reads in config file and ENV variables if set.