diff --git a/go.mod b/go.mod
index d978be5..96b8523 100644
--- a/go.mod
+++ b/go.mod
@@ -35,6 +35,7 @@ require (
 	filippo.io/edwards25519 v1.2.0 // indirect
 	github.com/alibabacloud-go/alibabacloud-gateway-spi v0.0.5 // indirect
 	github.com/alibabacloud-go/debug v1.0.1 // indirect
+	github.com/alibabacloud-go/dysmsapi-20180501/v2 v2.0.8 // indirect
 	github.com/aliyun/credentials-go v1.4.13 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
diff --git a/go.sum b/go.sum
index a36fde8..912bda8 100644
--- a/go.sum
+++ b/go.sum
@@ -30,6 +30,8 @@ github.com/alibabacloud-go/debug v0.0.0-20190504072949-9472017b5c68/go.mod h1:6p
 github.com/alibabacloud-go/debug v1.0.0/go.mod h1:8gfgZCCAC3+SCzjWtY053FrOcd4/qlH6IHTI4QyICOc=
 github.com/alibabacloud-go/debug v1.0.1 h1:MsW9SmUtbb1Fnt3ieC6NNZi6aEwrXfDksD4QA6GSbPg=
 github.com/alibabacloud-go/debug v1.0.1/go.mod h1:8gfgZCCAC3+SCzjWtY053FrOcd4/qlH6IHTI4QyICOc=
+github.com/alibabacloud-go/dysmsapi-20180501/v2 v2.0.8 h1:aDPyz6C+nenypx24N5qEt09NjpS6mu7Cu1A+wf9UTaY=
+github.com/alibabacloud-go/dysmsapi-20180501/v2 v2.0.8/go.mod h1:e/vWJ5gLVnraPROSh+3oMSodf5ukaUlqNgH0IIcnz98=
 github.com/alibabacloud-go/endpoint-util v1.1.0 h1:r/4D3VSw888XGaeNpP994zDUaxdgTSHBbVfZlzf6b5Q=
 github.com/alibabacloud-go/endpoint-util v1.1.0/go.mod h1:O5FuCALmCKs2Ff7JFJMudHs0I5EBgecXXxZRyswlEjE=
 github.com/alibabacloud-go/openapi-util v0.1.0 h1:0z75cIULkDrdEhkLWgi9tnLe+KhAFE/r5Pb3312/eAY=
diff --git a/rpc/chore/chore.proto b/rpc/chore/chore.proto
index e26ac36..ba5d13d 100644
--- a/rpc/chore/chore.proto
+++ b/rpc/chore/chore.proto
@@ -4,6 +4,7 @@ package chore;
 option go_package = "lone-services/rpc/chore";
 import "google/api/annotations.proto";
 
+// 应放到pkg
 service Chore {
   rpc Policy(PolicyReq) returns (Response) {
     option (google.api.http) = {
diff --git a/services/user/internal/logic/authHelper.go b/services/user/internal/logic/authHelper.go
index c2f8d9b..fc4e244 100644
--- a/services/user/internal/logic/authHelper.go
+++ b/services/user/internal/logic/authHelper.go
@@ -68,6 +68,21 @@ func findCredential(credentialType, identifier string) (*dao.UserCredential, err
 	return &cred, nil
 }
 
+func userHasEnabledClient(userId int64, clientCode string) (bool, error) {
+	var row dao.UserClient
+	clientModel := model.UserClientModel{}.Init()
+	if err := clientModel.GetOne(modelbase.Params{
+		Eq: map[string]string{
+			"user_id":     strconv.FormatInt(userId, utils.NumberTen),
+			"client_code": clientCode,
+			"status":      strconv.Itoa(int(dao.StatusEnabled)),
+		},
+	}, &row); err != nil {
+		return false, err
+	}
+	return row.Id >= utils.NumberOne, nil
+}
+
 func loadEnabledUser(userId int64) (*dao.UserRow, error) {
 	var row dao.UserRow
 	userModel := model.UserModel{}.Init()
diff --git a/services/user/internal/logic/loginLogic.go b/services/user/internal/logic/loginLogic.go
index f3f5870..bb1557e 100644
--- a/services/user/internal/logic/loginLogic.go
+++ b/services/user/internal/logic/loginLogic.go
@@ -39,7 +39,7 @@ func (l *LoginLogic) Login(in *user.LoginReq) (*user.Response, error) {
 	case dao.GrantTypeOpenid:
 		return l.loginByOpenid(req)
 	case dao.GrantTypePassword:
-		return outResponse(utils.ErrorParams, "密码登录暂未开放"), nil
+		return l.loginByPassword(req)
 	case dao.GrantTypeSms:
 		return outResponse(utils.ErrorParams, "验证码登录暂未开放"), nil
 	default:
@@ -91,3 +91,60 @@ func (l *LoginLogic) loginByOpenid(req validator.LoginValidator) (*user.Response
 	}
 	return okResponse(ret), nil
 }
+
+func (l *LoginLogic) loginByPassword(req validator.LoginValidator) (*user.Response, error) {
+	client, err := loadEnabledClient(req.ClientCode)
+	if err != nil {
+		l.Errorf("login load client: %v", err)
+		return failResponse(utils.Fail), nil
+	}
+	if !clientAllowsGrant(client.AllowedGrants, dao.GrantTypePassword) {
+		return outResponse(utils.ErrorParams, "该端不支持密码登录"), nil
+	}
+
+	if len(req.Mobile) != utils.NumberEleven {
+		return failResponse(utils.ErrorMobileError), nil
+	}
+	encryptMobile, encErr := utils.EncryptPhone(req.Mobile)
+	if encErr != nil {
+		l.Errorf("login encrypt mobile: %v", encErr)
+		return failResponse(utils.ErrorEncryptAesError), nil
+	}
+
+	cred, credErr := findCredential(dao.CredentialTypePassword, encryptMobile)
+	if credErr != nil {
+		l.Errorf("login find credential: %v", credErr)
+		return failResponse(utils.Fail), nil
+	}
+	if cred == nil {
+		return failResponse(utils.ErrorNotFund), nil
+	}
+	if cred.Status == dao.StatusDisabled {
+		return outResponse(utils.Fail, "登录凭证已禁用"), nil
+	}
+	if !utils.EqualsPassword(req.Password, cred.Secret) {
+		return failResponse(utils.ErrorPwdError), nil
+	}
+
+	hasClient, clientErr := userHasEnabledClient(cred.UserId, req.ClientCode)
+	if clientErr != nil {
+		l.Errorf("login check user client: %v", clientErr)
+		return failResponse(utils.Fail), nil
+	}
+	if !hasClient {
+		return outResponse(utils.ErrorParams, "该端未开通或已禁用"), nil
+	}
+
+	row, userErr := loadEnabledUser(cred.UserId)
+	if userErr != nil {
+		l.Errorf("login load user: %v", userErr)
+		return failResponse(utils.ErrorNotFund), nil
+	}
+
+	ret, tokenErr := issueLoginToken(l.ctx, l.svcCtx.JWT, l.svcCtx.SaleSvcName, row, client)
+	if tokenErr != nil {
+		l.Errorf("login issue token: %v", tokenErr)
+		return failResponse(utils.Fail), nil
+	}
+	return okResponse(ret), nil
+}