diff --git a/CHANGELOG b/CHANGELOG
index 048e83f6fb..89bb60654a 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,6 +1,8 @@
 v3.3.milestone0 (2017-10-04)
 ----------------------------
 
+* UI: added user roles
+
 * added config option `--log.color` to toggle colorful logging to terminal
 
 * added config option `--log.thread-name` to additionally log thread names 
diff --git a/js/apps/system/_admin/aardvark/APP/frontend/js/templates/userManagementView.ejs b/js/apps/system/_admin/aardvark/APP/frontend/js/templates/userManagementView.ejs
index a4bf8206a2..a77f647169 100644
--- a/js/apps/system/_admin/aardvark/APP/frontend/js/templates/userManagementView.ejs
+++ b/js/apps/system/_admin/aardvark/APP/frontend/js/templates/userManagementView.ejs
@@ -71,18 +71,21 @@
                 avatar = '<img src="';
 
               if (! img) {
-                avatar += 'img/default_user.png';
+                avatar = '<i id="' + _.escape(username) + '" class="collection-type-icon fa fa-user"></i>';
               } else {
                 avatar += 'https://s.gravatar.com/avatar/';
                 avatar += img;
                 avatar += '?s=50';
+                avatar += '" height="50" width="50" alt="" class="icon" id="';
+                avatar += _.escape(username);
+                avatar += '" />';
               }
-              avatar += '" height="50" width="50" alt="" class="icon" id="';
-              avatar += _.escape(username);
-              avatar += '" />';
               if (! name) {
                 name = " ";
               }
+              if (username.substring(0, 6) === ':role:') {
+                avatar = '<i id="' + _.escape(username) + '" class="collection-type-icon fa fa-group"></i>';
+              }
       %>
 
       <div class="tile pure-u-1-1 pure-u-sm-1-2 pure-u-md-1-3 pure-u-lg-1-4 pure-u-xl-1-6">
diff --git a/js/apps/system/_admin/aardvark/APP/frontend/js/views/modalView.js b/js/apps/system/_admin/aardvark/APP/frontend/js/views/modalView.js
index 7fd8abe23d..2aa34c4e15 100644
--- a/js/apps/system/_admin/aardvark/APP/frontend/js/views/modalView.js
+++ b/js/apps/system/_admin/aardvark/APP/frontend/js/views/modalView.js
@@ -75,6 +75,7 @@
       NOTIFICATION: 'notification',
       DELETE: 'danger',
       NEUTRAL: 'neutral',
+      DISABLED: 'disabled',
       CLOSE: 'close'
     },
     tables: {
@@ -168,7 +169,7 @@
     },
 
     createDisabledButton: function (title) {
-      var disabledButton = createButtonStub(this.buttons.NEUTRAL, title);
+      var disabledButton = createButtonStub(this.buttons.DISABLED, title);
       disabledButton.disabled = true;
       return disabledButton;
     },
@@ -294,7 +295,12 @@
         }
       }
       _.each(buttons, function (b, i) {
-        if (b.disabled || !b.callback) {
+        if (b.disabled || b.type === 'disabled' || !b.callback) {
+          if (divID) {
+            $('#' + divID + ' ' + '#modalButton' + i).attr('disabled', true);
+          } else {
+            $('#modalButton' + i).attr('disabled', true);
+          }
           return;
         }
         if (b.type === self.buttons.DELETE && !noConfirm) {
diff --git a/js/apps/system/_admin/aardvark/APP/frontend/js/views/userManagementView.js b/js/apps/system/_admin/aardvark/APP/frontend/js/views/userManagementView.js
index da6813edc5..38a45177c6 100644
--- a/js/apps/system/_admin/aardvark/APP/frontend/js/views/userManagementView.js
+++ b/js/apps/system/_admin/aardvark/APP/frontend/js/views/userManagementView.js
@@ -166,6 +166,12 @@
         active: status,
         extra: {name: name}
       };
+
+      if (frontendConfig.isEnterprise && $('#newRole').is(':checked')) {
+        options.user = ':role:' + userName;
+        delete options.passwd;
+      }
+
       this.collection.create(options, {
         wait: true,
         error: function (data, err) {
@@ -203,7 +209,7 @@
       }
 
       if ($(e.currentTarget).hasClass('tile')) {
-        e.currentTarget = $(e.currentTarget).find('img');
+        e.currentTarget = $(e.currentTarget).find('.fa');
       }
 
       this.collection.fetch({
@@ -255,6 +261,11 @@
       tableContent.push(
         window.modalView.createPasswordEntry('newPassword', 'Password', '', false, '', false)
       );
+      if (frontendConfig.isEnterprise) {
+        tableContent.push(
+          window.modalView.createCheckboxEntry('newRole', 'Role', false, false, false)
+        );
+      }
       tableContent.push(
         window.modalView.createCheckboxEntry('newStatus', 'Active', 'active', false, true)
       );
@@ -263,6 +274,16 @@
       );
 
       window.modalView.show('modalTable.ejs', 'Create New User', buttons, tableContent);
+
+      if (frontendConfig.isEnterprise) {
+        $('#newRole').on('change', function () {
+          if ($('#newRole').is(':checked')) {
+            $('#newPassword').attr('disabled', true);
+          } else {
+            $('#newPassword').attr('disabled', false);
+          }
+        });
+      }
     },
 
     evaluateUserName: function (str, substr) {
diff --git a/js/apps/system/_admin/aardvark/APP/frontend/js/views/userView.js b/js/apps/system/_admin/aardvark/APP/frontend/js/views/userView.js
index bf80c304f6..d70aa6211f 100644
--- a/js/apps/system/_admin/aardvark/APP/frontend/js/views/userView.js
+++ b/js/apps/system/_admin/aardvark/APP/frontend/js/views/userView.js
@@ -104,12 +104,20 @@
         )
       );
 
-      buttons.push(
-        window.modalView.createNotificationButton(
-          'Change Password',
-          this.editUserPassword.bind(this)
-        )
-      );
+      if (this.username.substring(0, 6) === ':role:') {
+        buttons.push(
+          window.modalView.createDisabledButton(
+            'Change Password'
+          )
+        );
+      } else {
+        buttons.push(
+          window.modalView.createNotificationButton(
+            'Change Password',
+            this.editUserPassword.bind(this)
+          )
+        );
+      }
       buttons.push(
         window.modalView.createSuccessButton(
           'Save',
@@ -161,23 +169,38 @@
           id: 'editStatus'
         }
       ];
-      buttons = [
+      buttons = [];
+      buttons.push(
         {
           title: 'Delete',
           type: window.modalView.buttons.DELETE,
           callback: this.submitDeleteUser.bind(this, username)
-        },
-        {
-          title: 'Change Password',
-          type: window.modalView.buttons.NOTIFICATION,
-          callback: this.createEditUserPasswordModal.bind(this, username)
-        },
+        }
+      );
+      if (this.username.substring(0, 6) === ':role:') {
+        buttons.push(
+          {
+            title: 'Change Password',
+            type: window.modalView.buttons.DISABLED,
+            callback: this.createEditUserPasswordModal.bind(this, username)
+          }
+        );
+      } else {
+        buttons.push(
+          {
+            title: 'Change Password',
+            type: window.modalView.buttons.NOTIFICATION,
+            callback: this.createEditUserPasswordModal.bind(this, username)
+          }
+        );
+      }
+      buttons.push(
         {
           title: 'Save',
           type: window.modalView.buttons.SUCCESS,
           callback: this.submitEditUser.bind(this, username)
         }
-      ];
+      );
 
       window.modalView.show(
         'modalTable.ejs',
diff --git a/js/apps/system/_admin/aardvark/APP/frontend/scss/_buttons.scss b/js/apps/system/_admin/aardvark/APP/frontend/scss/_buttons.scss
index 6e146c201e..4f7e9483d0 100644
--- a/js/apps/system/_admin/aardvark/APP/frontend/scss/_buttons.scss
+++ b/js/apps/system/_admin/aardvark/APP/frontend/scss/_buttons.scss
@@ -32,6 +32,12 @@
   @extend %neutral;
 }
 
+.button-disabled {
+  @extend %btn;
+  @extend %neutral;
+  cursor: not-allowed;
+}
+
 .button-header {
   @extend %bare-btn;
   @extend %header;