diff --git a/server/controllers/users.js b/server/controllers/users.js
index 10a7035..727b144 100644
--- a/server/controllers/users.js
+++ b/server/controllers/users.js
@@ -1,6 +1,8 @@
 const jwt = require('jsonwebtoken');
 
 const User = require('../models').User;
+const Role = require('../models').Role;
+const UserRole = require('../models').UserRole;
 
 module.exports = {
     create(req, res) {
@@ -38,5 +40,47 @@ module.exports = {
                 }
             })
             .catch(error => res.status(400).json({ data: error, message: 'No such user found' }));
-    }
-};
+    },
+
+    addUserRole(req,res){
+        const { value } = req.body;
+        const id = req.params.id;
+        return User
+            .findOne({ where: { id } })
+            .then(user => {
+                const id = user.id;
+                Role
+                    .findOne({ where: { value } })
+                    .then(role => {
+                         UserRole.create({
+                            UserId : id,
+                            RoleId : role.id,
+                        });
+                        res.status(200).json({message:'Role \'' + value +'\' added to user' });
+                    } )
+                    .catch(error => res.status(400).json({ data: error, message: 'No such role found' }))
+            } )
+            .catch(error => res.status(400).json({ data: error, message: 'No such user found' }));
+    },
+
+    removeUserRole(req,res){
+        const { value } = req.body;
+        const id = req.params.id;
+        return User
+            .findOne({ where: { id } })
+            .then(user => {
+                Role
+                    .findOne({ where: { value } })
+                    .then(role => {
+                        const id = user.id;
+                        UserRole
+                            .destroy({ where: { UserId:id, RoleId:role.id } 
+                            })
+                            .then(userrole => {res.status(200).json({message:'Role \'' + value +'\' removed from user' })})
+                            .catch(error => res.status(400).json({ data: error, message: 'No such role assigned to user' }));
+                    } )
+                    .catch(error => res.status(400).json({ data: error, message: 'No such role found' }))
+            } )
+        .catch(error => res.status(400).json({ data: error, message: 'No such user found' }));
+    },
+}
diff --git a/server/migrations/20190914234409-create-role.js b/server/migrations/20190914234409-create-role.js
new file mode 100644
index 0000000..1ee858c
--- /dev/null
+++ b/server/migrations/20190914234409-create-role.js
@@ -0,0 +1,27 @@
+'use strict';
+module.exports = {
+  up: (queryInterface, Sequelize) => {
+    return queryInterface.createTable('Roles', {
+      id: {
+        allowNull: false,
+        autoIncrement: true,
+        primaryKey: true,
+        type: Sequelize.INTEGER
+      },
+      value: {
+        type: Sequelize.ENUM('admin', 'candidate')
+      },
+      createdAt: {
+        allowNull: false,
+        type: Sequelize.DATE
+      },
+      updatedAt: {
+        allowNull: false,
+        type: Sequelize.DATE
+      }
+    });
+  },
+  down: (queryInterface, Sequelize) => {
+    return queryInterface.dropTable('Roles');
+  }
+};
\ No newline at end of file
diff --git a/server/migrations/20191008190353-create-user-role.js b/server/migrations/20191008190353-create-user-role.js
new file mode 100644
index 0000000..4f5cdee
--- /dev/null
+++ b/server/migrations/20191008190353-create-user-role.js
@@ -0,0 +1,40 @@
+'use strict';
+module.exports = {
+  up: (queryInterface, Sequelize) => {
+    return queryInterface.createTable('UserRoles', {
+      id: {
+        allowNull: false,
+        autoIncrement: true,
+        primaryKey: true,
+        type: Sequelize.INTEGER
+      },
+      UserId: {
+        type: Sequelize.INTEGER,
+        onDelete: 'CASCADE',
+       references: {
+            model: 'Users',
+            key: 'id'
+       }
+      },
+      RoleId: {
+        type: Sequelize.INTEGER,
+        onDelete: 'CASCADE',
+       references: {
+            model: 'Roles',
+            key: 'id'
+       }
+      },
+      createdAt: {
+        allowNull: false,
+        type: Sequelize.DATE
+      },
+      updatedAt: {
+        allowNull: false,
+        type: Sequelize.DATE
+      }
+    });
+  },
+  down: (queryInterface, Sequelize) => {
+    return queryInterface.dropTable('UserRoles');
+  }
+};
\ No newline at end of file
diff --git a/server/models/role.js b/server/models/role.js
new file mode 100644
index 0000000..065a16d
--- /dev/null
+++ b/server/models/role.js
@@ -0,0 +1,11 @@
+'use strict';
+module.exports = (sequelize, DataTypes) => {
+  const Role = sequelize.define('Role', {
+    value: DataTypes.ENUM('admin', 'candidate')
+  }, {});
+  Role.associate = function(models) {
+    Role.belongsToMany(models.User, {through: 'UserRole'});
+    
+  };
+  return Role;
+};
\ No newline at end of file
diff --git a/server/models/user.js b/server/models/user.js
index 7d21f5f..d78f84f 100644
--- a/server/models/user.js
+++ b/server/models/user.js
@@ -25,7 +25,7 @@ module.exports = (sequelize, DataTypes) => {
     },
   });
   User.associate = function(models) {
-    // associations can be defined here
+    User.belongsToMany(models.Role, {through: 'UserRole'}); 
   };
   return User;
 };
diff --git a/server/models/userrole.js b/server/models/userrole.js
new file mode 100644
index 0000000..75e1043
--- /dev/null
+++ b/server/models/userrole.js
@@ -0,0 +1,10 @@
+'use strict';
+module.exports = (sequelize, DataTypes) => {
+  const UserRole = sequelize.define('UserRole', {
+
+  }, {});
+  UserRole.associate = function(models) {
+    // associations can be defined here
+  };
+  return UserRole;
+};
\ No newline at end of file
diff --git a/server/routes/index.js b/server/routes/index.js
index 2ecfac4..42ab44b 100644
--- a/server/routes/index.js
+++ b/server/routes/index.js
@@ -11,4 +11,11 @@ module.exports = (app) => {
     app.post('/api/users', usersController.create);
     app.get('/api/users', usersController.list);
     app.get('/api/user', passport.authenticate('jwt', { session: false }), usersController.get);
+
+
+    app.patch('/api/users/:id/roles', usersController.addUserRole);
+    app.delete('/api/users/:id/roles', usersController.removeUserRole);
+
+
+
 };