diff --git a/ruoyi-admin/src/main/java/com/ruoyi/web/controller/backstage/BackstageController.java b/ruoyi-admin/src/main/java/com/ruoyi/web/controller/backstage/BackstageController.java
index c8935700..88888e20 100644
--- a/ruoyi-admin/src/main/java/com/ruoyi/web/controller/backstage/BackstageController.java
+++ b/ruoyi-admin/src/main/java/com/ruoyi/web/controller/backstage/BackstageController.java
@@ -6,10 +6,12 @@ import com.ruoyi.common.constant.Constants;
 import com.ruoyi.common.constant.HttpStatus;
 import com.ruoyi.common.core.domain.AjaxResult;
 import com.ruoyi.common.core.domain.entity.SysUser;
+import com.ruoyi.common.core.domain.model.AppLoginBody;
 import com.ruoyi.common.core.domain.model.LoginUser;
 import com.ruoyi.common.core.page.TableDataInfo;
 import com.ruoyi.common.utils.SecurityUtils;
 import com.ruoyi.common.utils.ip.IpUtils;
+import com.ruoyi.framework.web.service.SysLoginService;
 import com.ruoyi.system.domain.*;
 import com.ruoyi.system.domain.dto.*;
 import com.ruoyi.system.service.*;
@@ -71,6 +73,9 @@ public class BackstageController {
     @Autowired
     private IUserTypeService userTypeService;
 
+    @Autowired
+    private SysLoginService loginService;
+
     @GetMapping("/getAllUserInfo")
     public TableDataInfo getAllUserInfo(){
 
@@ -416,6 +421,26 @@ public class BackstageController {
         return error("无权限访问");
     }
 
+    // 后台账密登录
+    @PostMapping("/loginPassword")
+    public AjaxResult loginPassword(@RequestBody AppLoginBody loginBody) {
+        AjaxResult ajax = success();
+        // 生成令牌
+        String token = loginService.backstageLoginPassword(loginBody.getUsername(), loginBody.getPassword());
+        ajax.put(Constants.TOKEN, token);
+        return ajax;
+    }
+
+    // 后台验证码登录
+    @PostMapping("/loginSms")
+    public AjaxResult loginMessage(@RequestBody AppLoginBody loginBody) {
+        AjaxResult ajax = success();
+        // 生成令牌
+        String token = loginService.backstageLoginMessage(loginBody.getUsername(), loginBody.getCode(),loginBody.getPhone());
+        ajax.put(Constants.TOKEN, token);
+        return ajax;
+    }
+
 
 
 
diff --git a/ruoyi-common/src/main/java/com/ruoyi/common/constant/Constants.java b/ruoyi-common/src/main/java/com/ruoyi/common/constant/Constants.java
index 76983d8f..438f306d 100644
--- a/ruoyi-common/src/main/java/com/ruoyi/common/constant/Constants.java
+++ b/ruoyi-common/src/main/java/com/ruoyi/common/constant/Constants.java
@@ -9,6 +9,10 @@ import io.jsonwebtoken.Claims;
  */
 public class Constants
 {
+    /*
+    * 普通用户
+    * */
+    public static final String COMMON_USER="0000000000";
 
     /*
     * 作品审核通过
diff --git a/ruoyi-framework/src/main/java/com/ruoyi/framework/config/SecurityConfig.java b/ruoyi-framework/src/main/java/com/ruoyi/framework/config/SecurityConfig.java
index 547f79b2..20cab6c0 100644
--- a/ruoyi-framework/src/main/java/com/ruoyi/framework/config/SecurityConfig.java
+++ b/ruoyi-framework/src/main/java/com/ruoyi/framework/config/SecurityConfig.java
@@ -124,6 +124,8 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter
                         ,"/registerCheckPhone","/app/system/forgetPassword"
 //                        ,"/websocket/location/**"
                         ,"/websocket/online/**"
+                        ,"/backstage/system/loginPassword"
+                        ,"/backstage/system/loginSms"
 
 //                        , "/verifyRegisterSms"
 //                        ,"/app/system/**"
diff --git a/ruoyi-framework/src/main/java/com/ruoyi/framework/web/service/SysLoginService.java b/ruoyi-framework/src/main/java/com/ruoyi/framework/web/service/SysLoginService.java
index 3636d72f..a3176069 100644
--- a/ruoyi-framework/src/main/java/com/ruoyi/framework/web/service/SysLoginService.java
+++ b/ruoyi-framework/src/main/java/com/ruoyi/framework/web/service/SysLoginService.java
@@ -182,6 +182,64 @@ public class SysLoginService
         userService.updateUserProfile(sysUser);
     }
 
+    public String backstageLoginPassword(String username, String password){
+
+        loginPreCheck(username, password);
+
+        Authentication authentication = null;
+        try
+        {
+//            创建UsernamePasswordAuthenticationToken对象 用于封装用户名和密码 作为认证的凭证，'UsernamePasswordAuthenticationToken'是spring security存储认证请求信息的标准类
+            UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(username, password);
+//            设置认证上下文
+            AuthenticationContextHolder.setContext(authenticationToken);
+            /**
+             *  调用authenticationManager进行认证
+             *  该方法会通过传入的'authenticationToken'进行用户认证
+              */
+
+            authentication = authenticationManager.authenticate(authenticationToken);
+        }
+        catch (Exception e)
+        {
+            if (e instanceof BadCredentialsException)
+            {
+                AsyncManager.me().execute(AsyncFactory.recordLogininfor(username, Constants.LOGIN_FAIL, MessageUtils.message("user.password.not.match")));
+                throw new UserPasswordNotMatchException();
+            }
+            else
+            {
+                AsyncManager.me().execute(AsyncFactory.recordLogininfor(username, Constants.LOGIN_FAIL, e.getMessage()));
+                throw new ServiceException(e.getMessage());
+            }
+        }
+        finally
+        {
+            AuthenticationContextHolder.clearContext();
+        }
+
+
+        LoginUser loginUser = (LoginUser) authentication.getPrincipal();
+
+        String userType = loginUser.getUser().getUserType();
+
+        System.out.println("用户类型:"+userType);
+
+
+        if (userType.equals(Constants.COMMON_USER)){
+            AsyncManager.me().execute(AsyncFactory.recordLogininfor(username, Constants.LOGIN_FAIL, "user.login.not.authority"));
+            throw new ServiceException("无后台访问权限");
+//            return ;
+        }
+
+        AsyncManager.me().execute(AsyncFactory.recordLogininfor(username, Constants.LOGIN_SUCCESS, MessageUtils.message("user.login.success")));
+        recordLoginInfo(loginUser.getUserId());
+        // 生成token
+        return tokenService.createToken(loginUser);
+
+    }
+
+
     public String appLoginPassword(String username, String password) {
         // APP端验证码校验
 //        appvalidateCaptcha(username, code, phone);
@@ -227,6 +285,49 @@ public class SysLoginService
         return tokenService.createToken(loginUser);
     }
 
+    public String backstageLoginMessage(String username, String code,String phone) {
+
+        appvalidateCaptcha(username, code, phone);
+
+        Authentication authentication = null;
+        try {
+            // 该方法会去调用UserDetailsByPhonenumberServiceImpl.loadUserByUsername
+            authentication = authenticationManager.authenticate(new SmsCodeAuthenticationToken(phone));
+        } catch (Exception e) {
+            if (e instanceof BadCredentialsException) {
+                AsyncManager.me().execute(AsyncFactory.recordLogininfor(phone,
+                        Constants.LOGIN_FAIL, MessageUtils.message("account.not.incorrect")));
+                throw new UserPasswordNotMatchException();
+            } else {
+                AsyncManager.me().execute(AsyncFactory.recordLogininfor(phone,
+                        Constants.LOGIN_FAIL, e.getMessage()));
+                throw new ServiceException(e.getMessage());
+            }
+        }
+
+        // 获取登录人信息
+        LoginUser loginUser = (LoginUser) authentication.getPrincipal();
+
+        String userType = loginUser.getUser().getUserType();
+
+        if(userType.equals(Constants.COMMON_USER)){
+            AsyncManager.me().execute(AsyncFactory.recordLogininfor(username, Constants.LOGIN_FAIL, "user.login.not.authority"));
+            throw new ServiceException("无后台访问权限");
+        }
+
+
+        // 执行异步任务，记录登录信息
+        AsyncManager.me().execute(AsyncFactory.recordLogininfor(phone,
+                Constants.LOGIN_SUCCESS, MessageUtils.message("user.login.success")));
+
+        // 修改最近登录IP和登录时间
+        recordLoginInfo(loginUser.getUserId());
+        // 生成token
+        return tokenService.createToken(loginUser);
+
+
+    }
+
 
     /**
      *