diff --git a/wildfirestorage-cli/src/main/java/com/sjsu/wildfirestorage/Main.java b/wildfirestorage-cli/src/main/java/com/sjsu/wildfirestorage/Main.java
index fa9b69d..e750e1c 100644
--- a/wildfirestorage-cli/src/main/java/com/sjsu/wildfirestorage/Main.java
+++ b/wildfirestorage-cli/src/main/java/com/sjsu/wildfirestorage/Main.java
@@ -1,7 +1,9 @@
 package com.sjsu.wildfirestorage;
+
 import org.springframework.core.ParameterizedTypeReference;
 import org.springframework.util.LinkedMultiValueMap;
 import org.springframework.web.reactive.function.client.WebClient;
+import org.springframework.web.reactive.function.client.WebClientException;
 import picocli.CommandLine;
 
 import java.nio.file.Files;
@@ -23,24 +25,35 @@ static class Cli {
         public void datasetInfo(@CommandLine.Parameters(paramLabel = "fileName") String fileName, @CommandLine.Parameters(paramLabel = "hostname") String hostname) throws InterruptedException {
             System.out.println("GET returned: " + Client.get(Client.getWebClient(hostname + "/api/metadata"),
                     new LinkedMultiValueMap<String, String>(Map.of("filename", List.of(fileName))),
-                    new ParameterizedTypeReference<ArrayList<Metadata>>(){}));
+                    new ParameterizedTypeReference<ArrayList<Metadata>>() {
+                    }));
         }
 
         @CommandLine.Command
-        public void share(@CommandLine.Option(description = "Absolute file name", names = "--file", required = true) String fileName,
-                          @CommandLine.Parameters(paramLabel = "hostname") String hostname,
-                          @CommandLine.Option(names = "--token") String token) throws InterruptedException, ExecutionException {
-            System.out.println("POST returned: " + Client.post(Client.getWebClient(hostname + "/api/share-link/create"),
-                    fileName.replace("\"", ""),
-                    new ParameterizedTypeReference<String>(){}, httpHeaders -> {
-                        httpHeaders.setBearerAuth(token);
-                    }));
+        public void share(@CommandLine.Option(names = "--meta-url", description = "URL of metadata server", defaultValue = "http://127.0.0.1:27777") String metaURL,
+                          @CommandLine.Parameters(description = "Absolute file name", index = "0..*") String[] fileNames,
+                          @CommandLine.Option(names = "--token", required = true) String token) throws InterruptedException, ExecutionException {
+            for (var fileName : fileNames) {
+                try {
+                    System.out.println(Client.post(Client.getWebClient(metaURL + "/api/share-link/create"),
+                            fileName,
+                            new ParameterizedTypeReference<String>() {
+                            }, httpHeaders -> {
+                                httpHeaders.setBearerAuth(token);
+                            }));
+                } catch (ExecutionException e) {
+                    var message = e.getMessage();
+                    // if this is a message about a connection problem, drop all the text before connection
+                    if (message.contains("Connection")) message = message.substring(message.indexOf("Connection"));
+                    System.err.printf("%s: %s\n", message, fileName);
+                }
+            }
         }
 
         @CommandLine.Command
         public void search(@CommandLine.Parameters(paramLabel = "query") String query, @CommandLine.Parameters(paramLabel = "hostname") String hostname,
                            @CommandLine.Parameters(paramLabel = "<option>", defaultValue = "all", description = "Which information to print - 'all' or 'basic'") String option,
-                           @CommandLine.Option(names="--limit", defaultValue = "10") int limit,
+                           @CommandLine.Option(names = "--limit", defaultValue = "10") int limit,
                            @CommandLine.Option(names = "--offset", defaultValue = "0") int offset,
                            @CommandLine.Option(names = "--token") String token) throws InterruptedException, ExecutionException {
 
@@ -48,20 +61,20 @@ public void search(@CommandLine.Parameters(paramLabel = "query") String query, @
             metadataRequest.searchQuery = query;
             metadataRequest.limit = limit;
             metadataRequest.offset = offset;
-            metadataRequest.excludeFields = new String[] {"globalAttributes", "variables"};
+            metadataRequest.excludeFields = new String[]{"globalAttributes", "variables"};
             WebClient webClient = Client.getWebClient(hostname + "/api/metadata/search?excludeFields=globalAttributes,variables");
-            var res = (ArrayList<Metadata>)(Client.post(webClient, metadataRequest, new ParameterizedTypeReference<ArrayList<Metadata>>(){}, httpHeaders -> {
+            var res = (ArrayList<Metadata>) (Client.post(webClient, metadataRequest, new ParameterizedTypeReference<ArrayList<Metadata>>() {
+            }, httpHeaders -> {
                 httpHeaders.setBearerAuth(token);
             }));
             System.out.println("SEARCH returned: " + res.size() + " results");
             if (option.equals("all")) {
-                for (Metadata m: res) {
+                for (Metadata m : res) {
                     System.out.println("========================================================================");
                     PrintData.printAllData(m);
                 }
-            }
-            else {
-                for (Metadata m: res){
+            } else {
+                for (Metadata m : res) {
                     System.out.println("========================================================================");
                     PrintData.printBasic(m);
                 }
@@ -77,18 +90,20 @@ public void clean(@CommandLine.Parameters(paramLabel = "limit") int limit,
             LinkedMultiValueMap<String, String> parameters = new LinkedMultiValueMap<String, String>();
             parameters.add("limit", String.valueOf(limit));
             List<String> result;
-            int i=0;
+            int i = 0;
             WebClient webClient = Client.getWebClient(hostname + "/api/metadata/filepath");
 
             do {
                 parameters.put("offset", List.of(String.valueOf(offset)));
                 result = (List<String>) Client.get(webClient,
                         parameters,
-                        new ParameterizedTypeReference<List<String>>() {});
+                        new ParameterizedTypeReference<List<String>>() {
+                        });
                 System.out.println("The following Metadata documents will be removed from the database:");
                 result.forEach(str -> System.out.println(str));
                 List<String> deletedFiles = result.stream().filter(item -> !Files.exists(Paths.get(item))).toList();
-                System.out.println("DELETE RESULT:" + Client.post(webClient, deletedFiles, new ParameterizedTypeReference<Integer>() {}, httpHeaders -> {
+                System.out.println("DELETE RESULT:" + Client.post(webClient, deletedFiles, new ParameterizedTypeReference<Integer>() {
+                }, httpHeaders -> {
                     httpHeaders.setBearerAuth(token);
                 }));
                 offset += limit;
diff --git a/wildfirestorage-spring/app/package-lock.json b/wildfirestorage-spring/app/package-lock.json
index 4954075..c2fde13 100644
--- a/wildfirestorage-spring/app/package-lock.json
+++ b/wildfirestorage-spring/app/package-lock.json
@@ -26,6 +26,7 @@
       },
       "devDependencies": {
         "daisyui": "^3.9.3",
+        "react-router-dom": "^6.22.1",
         "tailwindcss": "^3.3.3"
       }
     },
@@ -3474,6 +3475,15 @@
         }
       }
     },
+    "node_modules/@remix-run/router": {
+      "version": "1.15.1",
+      "resolved": "https://registry.npmjs.org/@remix-run/router/-/router-1.15.1.tgz",
+      "integrity": "sha512-zcU0gM3z+3iqj8UX45AmWY810l3oUmXM7uH4dt5xtzvMhRtYVhKGOmgOd1877dOPPepfCjUv57w+syamWIYe7w==",
+      "dev": true,
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
     "node_modules/@rollup/plugin-babel": {
       "version": "5.3.1",
       "resolved": "https://registry.npmjs.org/@rollup/plugin-babel/-/plugin-babel-5.3.1.tgz",
@@ -16796,6 +16806,38 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/react-router": {
+      "version": "6.22.1",
+      "resolved": "https://registry.npmjs.org/react-router/-/react-router-6.22.1.tgz",
+      "integrity": "sha512-0pdoRGwLtemnJqn1K0XHUbnKiX0S4X8CgvVVmHGOWmofESj31msHo/1YiqcJWK7Wxfq2a4uvvtS01KAQyWK/CQ==",
+      "dev": true,
+      "dependencies": {
+        "@remix-run/router": "1.15.1"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      },
+      "peerDependencies": {
+        "react": ">=16.8"
+      }
+    },
+    "node_modules/react-router-dom": {
+      "version": "6.22.1",
+      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-6.22.1.tgz",
+      "integrity": "sha512-iwMyyyrbL7zkKY7MRjOVRy+TMnS/OPusaFVxM2P11x9dzSzGmLsebkCvYirGq0DWB9K9hOspHYYtDz33gE5Duw==",
+      "dev": true,
+      "dependencies": {
+        "@remix-run/router": "1.15.1",
+        "react-router": "6.22.1"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      },
+      "peerDependencies": {
+        "react": ">=16.8",
+        "react-dom": ">=16.8"
+      }
+    },
     "node_modules/react-scripts": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/react-scripts/-/react-scripts-5.0.1.tgz",
diff --git a/wildfirestorage-spring/app/package.json b/wildfirestorage-spring/app/package.json
index 089bd73..2f3fe38 100644
--- a/wildfirestorage-spring/app/package.json
+++ b/wildfirestorage-spring/app/package.json
@@ -46,6 +46,7 @@
   },
   "devDependencies": {
     "daisyui": "^3.9.3",
+    "react-router-dom": "^6.22.1",
     "tailwindcss": "^3.3.3"
   }
 }
diff --git a/wildfirestorage-spring/app/src/App.js b/wildfirestorage-spring/app/src/App.js
index 1264fca..59d7c57 100644
--- a/wildfirestorage-spring/app/src/App.js
+++ b/wildfirestorage-spring/app/src/App.js
@@ -1,26 +1,46 @@
 import './App.css';
-import SideBar from './components/sidebar/sidebar';
-import MapContainer from './components/map-container/mapContainer';
-import Navbar from './components/navbar/navbar';
-import Workspace from './components/workspace/workspace';
+import Home from './components/home/home';
+import { BrowserRouter, Routes, Route } from "react-router-dom";
+import Landing from './components/landing/landing';
+import Token from './components/token/token';
+import Forbidden from './components/forbidden/forbidden';
+import { useDispatch } from 'react-redux';
+import { setOpaqueToken } from './redux/userSlice';
+import { useEffect } from 'react';
 
 function App() {
+  const dispatch = useDispatch();
+  
+  const getToken = async () => {
+    const response = await fetch("/api/oauth/token", {
+      method: "GET",
+      headers: {
+        "Content-Type": "application/json",
+        "Accept": "text/plain, application/json",
+      },
+      credentials: "include",
+      redirect: "follow",
+    });
+    if (response.redirected) {
+      document.location = response.url;
+    }
+    let d = await response.text();
+    dispatch(setOpaqueToken(d));
+    console.log("tokennnn", d)
+  }
+  useEffect(() => {
+    getToken();
+  }, [])
 
   return (
-    <div className='flex flex-col w-screen h-screen absolute'>
-      <Navbar />
-      <div className='flex-1 grid grid-cols-[100px_repeat(12,_minmax(0,_1fr))]'>
-        <div id="sidebar" className='basis-20 text-white bg-primary shadow-lg shadow-primary'>
-          <SideBar />
-        </div>
-        <div id="workspace" className='col-span-4 shadow-lg' style={{"height": `calc(100vh - 4rem)`, "overflowY": "scroll"}}>
-          <Workspace />
-        </div>
-        <div id="map" className='col-span-8'>
-          <MapContainer style={{"height": `calc(100vh - 4rem)`}}/>
-        </div>
-      </div>
-    </div>
+    <BrowserRouter>
+      <Routes>
+        <Route path="/" element={<Landing />} />
+        <Route path="/home" element={<Home />} />
+        <Route path="/token" element={<Token />} />
+        <Route path="/forbidden" element={<Forbidden />} />
+      </Routes>
+    </BrowserRouter>
   )
 }
 
diff --git a/wildfirestorage-spring/app/src/components/forbidden/forbidden.jsx b/wildfirestorage-spring/app/src/components/forbidden/forbidden.jsx
new file mode 100644
index 0000000..de8a7f8
--- /dev/null
+++ b/wildfirestorage-spring/app/src/components/forbidden/forbidden.jsx
@@ -0,0 +1,12 @@
+const Forbidden = () => {
+    return (
+        <div className="flex place-content-center">
+            <div className="h-screen flex flex-col place-content-center w-9/12">
+                <h1 className="h-40 flex flex-col justify-center text-center text-5xl font-bold">Uh oh! Looks like you do not have access to use this feature :( </h1>
+                <h1 className="h-40 flex flex-col justify-center text-center text-xl">Please contact the admin if you think this is incorrect! </h1>
+            </div>
+        </div>
+    );
+}
+
+export default Forbidden;
\ No newline at end of file
diff --git a/wildfirestorage-spring/app/src/components/home/home.jsx b/wildfirestorage-spring/app/src/components/home/home.jsx
new file mode 100644
index 0000000..ee2863f
--- /dev/null
+++ b/wildfirestorage-spring/app/src/components/home/home.jsx
@@ -0,0 +1,25 @@
+import SideBar from '../sidebar/sidebar';
+import MapContainer from '../map-container/mapContainer';
+import Workspace from '../workspace/workspace';
+import Navbar from '../navbar/navbar';
+
+const Home = () => {
+    return (
+        <div className='flex flex-col w-screen h-screen absolute'>
+            <Navbar />
+            <div className='flex-1 grid grid-cols-[100px_repeat(12,_minmax(0,_1fr))]'>
+                <div id="sidebar" className='basis-20 text-white bg-primary shadow-lg shadow-primary'>
+                    <SideBar />
+                </div>
+                <div id="workspace" className='col-span-4 shadow-lg' style={{ "height": `calc(100vh - 4rem)`, "overflowY": "scroll" }}>
+                    <Workspace />
+                </div>
+                <div id="map" className='col-span-8'>
+                    <MapContainer style={{ "height": `calc(100vh - 4rem)` }} />
+                </div>
+            </div>
+        </div>
+    );
+}
+
+export default Home;
\ No newline at end of file
diff --git a/wildfirestorage-spring/app/src/components/landing/landing.jsx b/wildfirestorage-spring/app/src/components/landing/landing.jsx
new file mode 100644
index 0000000..be63977
--- /dev/null
+++ b/wildfirestorage-spring/app/src/components/landing/landing.jsx
@@ -0,0 +1,44 @@
+import { Link, useNavigate } from "react-router-dom";
+
+const Landing = () => {
+    const navigate = useNavigate();
+
+    const goToSearch = async () => {
+        const response = await fetch("/api/oauth/checkAccess", {
+            method: "GET",
+            headers: {
+                "Content-Type": "application/json",
+                "Accept": "text/plain, application/json",
+            },
+            credentials: "include",
+            redirect: "follow",
+        });
+        if (response.redirected) {
+            document.location = response.url;
+        } else if (response.status === 403) {
+            navigate("/forbidden");
+        } else {
+            navigate("/home");
+        }
+    }
+    
+    return (
+        <div className="flex place-content-center">
+            <div className="h-screen flex flex-col place-content-center w-9/12">
+                <h1 className="h-40 flex flex-col justify-center text-center text-5xl font-bold">Hello! What would you like to do?</h1>
+                <div className="h-40 flex justify-center">
+                    <div className="flex items-center w-4/6">
+                        <div className="grid h-20 w-40 flex-grow btn btn-outline rounded-box place-items-center"><span className="font-normal text-lg"><Link to="/token">Generate Token</Link></span></div>
+                        <div className="divider divider-horizontal"></div>
+                        <div className="grid h-20 w-40 flex-grow btn btn-outline rounded-box place-items-center"><a className="font-normal text-lg" onClick={goToSearch}>Search</a></div>
+                    </div>
+                </div>
+                <div className="h-40 p-8 flex flex-col justify-center">
+                    <button className="btn flex-none self-center"><a href="/logout">Logout</a></button>
+                </div>
+            </div>
+        </div>
+    );
+}
+
+export default Landing;
\ No newline at end of file
diff --git a/wildfirestorage-spring/app/src/components/map-container/mapContainer.jsx b/wildfirestorage-spring/app/src/components/map-container/mapContainer.jsx
index 3f1d0f4..237d025 100644
--- a/wildfirestorage-spring/app/src/components/map-container/mapContainer.jsx
+++ b/wildfirestorage-spring/app/src/components/map-container/mapContainer.jsx
@@ -77,10 +77,12 @@ const MapContainer = () => {
       map.data.remove(feature);
     })
     for (let record of metadataRecords) {
-      let geoJsonFeature = feature(record.location);
-      geoJsonFeature.properties = { "id": record.digestString }
-      map.data.addGeoJson(geoJsonFeature);
-      map.data.addGeoJson(centroid(record.location));
+      if(record.location) {
+        let geoJsonFeature = feature(record.location);
+        geoJsonFeature.properties = { "id": record.digestString }
+        map.data.addGeoJson(geoJsonFeature);
+        map.data.addGeoJson(centroid(record.location));
+      }
     }
   }
 
diff --git a/wildfirestorage-spring/app/src/components/token/token.jsx b/wildfirestorage-spring/app/src/components/token/token.jsx
new file mode 100644
index 0000000..a71b8e2
--- /dev/null
+++ b/wildfirestorage-spring/app/src/components/token/token.jsx
@@ -0,0 +1,32 @@
+import { GoCopy } from 'react-icons/go';
+import { useSelector } from 'react-redux';
+
+const Token = () => {
+
+    const token = useSelector(state => state.userReducer.opaqueToken)
+
+
+    const copyToClipboard = (event) => {
+        navigator.clipboard.writeText(token);
+    }
+
+    return (
+        <div className="flex place-content-center">
+            <div className="h-screen flex flex-col place-content-center w-9/12">
+                <h1 className="h-40 flex flex-col justify-center text-center text-5xl font-normal">Your token is </h1>
+                <div className="flex flex-row px-6 justify-between h-20 card bg-base-300 rounded-box place-items-center text-3xl font-bold">
+                    <div>{token}</div>
+                    <div>
+                        <div className="tooltip focus:tooltip-open" data-tip="Copy">
+                            <button className="btn btn-square btn-outline" onClick={copyToClipboard}>
+                                <GoCopy size="28" />
+                            </button>
+                        </div>
+                    </div>
+                </div>
+            </div>
+        </div>
+    )
+}
+
+export default Token;
\ No newline at end of file
diff --git a/wildfirestorage-spring/app/src/components/workspace/workspace.jsx b/wildfirestorage-spring/app/src/components/workspace/workspace.jsx
index 01b4c6b..e94b2fa 100644
--- a/wildfirestorage-spring/app/src/components/workspace/workspace.jsx
+++ b/wildfirestorage-spring/app/src/components/workspace/workspace.jsx
@@ -4,7 +4,6 @@ import SearchResultContainer from '../searchResultContainer/searchResultContaine
 import { useEffect, useState } from 'react';
 import { useDispatch, useSelector } from 'react-redux';
 import { setMetadata } from '../../redux/metadataSlice';
-import { setOpaqueToken } from '../../redux/userSlice';
 import {addQuery, deleteQuery, setQueryCount} from '../../redux/filterSlice';
 import Modal from '../modal/modal';
 import {setSearchTerm} from "../../redux/searchTermSlice";
@@ -63,7 +62,6 @@ const Workspace = () => {
 
     useEffect(() => {
         getData();
-        getToken();
         getQueryCount();
     }, [])
 
@@ -76,23 +74,7 @@ const Workspace = () => {
         getData();
     }, [limit, offset])
 
-    const getToken = async () => {
-        const response = await fetch("/token", {
-            method: "GET",
-            headers: {
-                "Content-Type": "application/json",
-                "Accept": "text/html, application/json",
-            },
-            credentials: "include",
-            redirect: "follow",
-        });
-        if (response.redirected) {
-            document.location = response.url;
-        }
-        let d = await response.text();
-        dispatch(setOpaqueToken(d.substring(6)));
-        console.log("tokennnn", d)
-    }
+    
 
     const handleDeleteFilter = (event) => {
         const deleteID = event.target.parentNode.id
diff --git a/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/CustomOAuth2User.java b/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/CustomOAuth2User.java
deleted file mode 100644
index 2cda56e..0000000
--- a/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/CustomOAuth2User.java
+++ /dev/null
@@ -1,26 +0,0 @@
-package com.sjsu.wildfirestorage.spring.controller;
-
-import java.util.Collection;
-import java.util.Map;
-
-import org.springframework.security.core.GrantedAuthority;
-import org.springframework.security.oauth2.core.user.OAuth2User;
-
-public class CustomOAuth2User implements OAuth2User {
-    private OAuth2User oauth2User;
-    public CustomOAuth2User(OAuth2User oauth2User) {
-        this.oauth2User = oauth2User;
-    }
-    @Override
-    public Map<String, Object> getAttributes() {
-        return oauth2User.getAttributes();
-    }
-    @Override
-    public Collection<? extends GrantedAuthority> getAuthorities() {
-        return oauth2User.getAuthorities();
-    }
-    @Override
-    public String getName() {
-        return oauth2User.getAttribute("name");
-    }
-}
diff --git a/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/CustomOAuth2UserService.java b/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/CustomOAuth2UserService.java
deleted file mode 100644
index 9dec594..0000000
--- a/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/CustomOAuth2UserService.java
+++ /dev/null
@@ -1,16 +0,0 @@
-package com.sjsu.wildfirestorage.spring.controller;
-
-import org.springframework.security.oauth2.client.userinfo.DefaultOAuth2UserService;
-import org.springframework.security.oauth2.client.userinfo.OAuth2UserRequest;
-import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
-import org.springframework.security.oauth2.core.user.OAuth2User;
-import org.springframework.stereotype.Service;
-
-@Service
-public class CustomOAuth2UserService extends DefaultOAuth2UserService  {
-    @Override
-    public OAuth2User loadUser(OAuth2UserRequest userRequest) throws OAuth2AuthenticationException {
-        OAuth2User user =  super.loadUser(userRequest);
-        return new CustomOAuth2User(user);
-    }
-}
\ No newline at end of file
diff --git a/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/DatasetController.java b/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/DatasetController.java
index ede6a67..b16b10e 100644
--- a/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/DatasetController.java
+++ b/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/DatasetController.java
@@ -14,6 +14,8 @@
 import org.springframework.data.mongodb.core.query.Criteria;
 import org.springframework.data.mongodb.core.query.Query;
 import org.springframework.data.mongodb.core.query.Update;
+import org.springframework.security.access.annotation.Secured;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 
 import java.io.IOException;
@@ -33,6 +35,7 @@ public class DatasetController {
 
     private final Path datasetCreationLog = Paths.get("DatasetCreation.log");
 
+    @PreAuthorize("hasRole('USER')")
     @PostMapping("/dataset")
     public int upsertDataset() throws MongoWriteException {
         AggregationOptions options = AggregationOptions.builder().allowDiskUse(true).build();
diff --git a/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/MetadataController.java b/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/MetadataController.java
index e9b0345..1d49707 100644
--- a/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/MetadataController.java
+++ b/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/MetadataController.java
@@ -12,6 +12,8 @@
 import org.springframework.data.mongodb.core.query.Criteria;
 import org.springframework.data.mongodb.core.query.Query;
 import org.springframework.data.mongodb.core.query.Update;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.web.bind.annotation.*;
 
 import java.util.Date;
@@ -33,6 +35,7 @@ public class MetadataController {
      * @return a list of matching Metadata documents
      * @throws JSQLParserException
      */
+    @PreAuthorize("hasRole('USER')")
     @PostMapping("/metadata/search")
     public List<Metadata> search(@RequestBody MetadataRequest request) throws JSQLParserException {
         Query query = new Query();
@@ -52,8 +55,11 @@ public List<Metadata> search(@RequestBody MetadataRequest request) throws JSQLPa
         return res;
     }
 
+    @PreAuthorize("hasRole('USER')")
     @PostMapping("/metadata/search/count")
     public long searchCount(@RequestBody MetadataRequest request) throws JSQLParserException {
+        SecurityContextHolder.getContext().getAuthentication().getAuthorities().forEach(ga -> System.out.println("^^^^^^^^^^^"+ga));
+        System.out.println();
         Query query = new Query();
         Criteria criteria = CriteriaBuilder.buildFromSQL(request.searchQuery);
         if(criteria != null) {
@@ -65,6 +71,7 @@ public long searchCount(@RequestBody MetadataRequest request) throws JSQLParserE
         return mongoTemplate.count(query, Metadata.class);
     }
 
+    @PreAuthorize("hasRole('GUEST')")
     @GetMapping("/metadata/{digestString}")
     public DBObject getMetadataByDigest(@PathVariable String digestString) {
         Query query = new Query(Criteria.where("digestString").is(digestString));
@@ -77,6 +84,7 @@ public DBObject getMetadataByDigest(@PathVariable String digestString) {
      * @param fileName the file whose metadata is to be retrieved
      * @return Metadata related to the filename
      */
+    @PreAuthorize("hasRole('USER')")
     @GetMapping("/metadata")
     public List<DBObject> getFileMetadata(@RequestParam("filename") String fileName) {
         Query query = new Query(Criteria.where("fileName").regex(".*"+fileName+".*"));
@@ -90,6 +98,7 @@ public List<DBObject> getFileMetadata(@RequestParam("filename") String fileName)
      * @return 0 on success
      * @throws MongoWriteException
      */
+    @PreAuthorize("hasRole('USER')")
     @PostMapping("/metadata")
     public int upsertMetadata(@RequestBody Metadata metadata) throws MongoWriteException {
         // Convert string date to date type to allow querying on dates
@@ -123,6 +132,7 @@ public int upsertMetadata(@RequestBody Metadata metadata) throws MongoWriteExcep
         return 0;
     }
 
+    @PreAuthorize("hasRole('ADMIN')")
     @GetMapping("/metadata/filepath")
     public List<String> getFilePaths(@RequestParam("limit") int limit, @RequestParam("offset") int offset) {
         Aggregation aggregation = Aggregation.newAggregation(
@@ -140,6 +150,7 @@ public List<String> getFilePaths(@RequestParam("limit") int limit, @RequestParam
         return files;
     }
 
+    @PreAuthorize("hasRole('ADMIN')")
     @PostMapping("/metadata/filepath")
     public int deleteMetadata(@RequestBody List<String> filePaths) {
         Query query = new Query(Criteria.where("filePath").in(filePaths));
diff --git a/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/OauthController.java b/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/OauthController.java
index 5416d45..3f77f54 100644
--- a/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/OauthController.java
+++ b/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/OauthController.java
@@ -7,12 +7,9 @@
 import org.springframework.data.mongodb.core.query.Query;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.security.access.annotation.Secured;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
-import org.springframework.security.oauth2.core.OAuth2AccessToken;
-import org.springframework.security.oauth2.core.OAuth2AuthenticatedPrincipal;
-import org.springframework.security.oauth2.core.oidc.user.DefaultOidcUser;
 import org.springframework.security.oauth2.core.user.OAuth2User;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.GetMapping;
@@ -33,31 +30,44 @@ public class OauthController {
 
     @Value("${custom.expireAfterSeconds:2592000/}")
     private long expireAfterSeconds;
-  
+
+    @PreAuthorize("hasRole('GUEST')")
     @GetMapping("/")
     public String index () { return "index.html"; }
 
-    @GetMapping("/user")
+    @PreAuthorize("hasRole('GUEST')")
+    @GetMapping("/api/oauth/user")
     public ResponseEntity<String> user(OAuth2User user) {
         Map details = user.getAttributes();
         var name = details.get("login");
         return new ResponseEntity<>(name.toString(), HttpStatus.OK);
     }
 
-    @GetMapping("/userInfo")
+    @GetMapping("/api/oauth/userInfo")
     public ResponseEntity<String> info(Principal user) {
         return new ResponseEntity<>(user.toString(), HttpStatus.OK);
     }
 
-    @GetMapping("/token")
+    @PreAuthorize("hasRole('GUEST')")
+    @GetMapping("/api/oauth/token")
     public ResponseEntity<String> token(OAuth2AuthenticationToken user) {
         String opaqueToken = getOpaqueToken(user);
-        return new ResponseEntity<>("token=" + opaqueToken, HttpStatus.OK);
+        return new ResponseEntity<>(opaqueToken, HttpStatus.OK);
+    }
+
+    @PreAuthorize("hasRole('USER')")
+    @GetMapping("/api/oauth/checkAccess")
+    public ResponseEntity<Boolean> checkAccess() {
+        return new ResponseEntity<>(true, HttpStatus.OK);
     }
 
     public String getOpaqueToken(OAuth2AuthenticationToken user) {
         String name = user.getPrincipal().getAttribute("name");
-        Query query = new Query(Criteria.where("name").is(name));
+        String email = user.getPrincipal().getAttribute("email");
+        if(email == null) {
+            email = user.getPrincipal().getAttribute("login") + "@github";
+        }
+        Query query = new Query(Criteria.where("email").is(email));
         var opaqueTokenMap = mongoTemplate.find(query, Map.class, USER_COLLECTION);
         String opaqueToken = null;
         if(!opaqueTokenMap.isEmpty()) {
@@ -70,8 +80,10 @@ public String getOpaqueToken(OAuth2AuthenticationToken user) {
             opaqueToken = Base64.getUrlEncoder().encodeToString(randomBytes);
             Map<String, Object> map = new HashMap<>();
             map.put("name", name);
+            map.put("email", email);
             map.put("token", opaqueToken);
             map.put("expiry", Instant.now().plusSeconds(expireAfterSeconds));
+            map.put("role", "ROLE_GUEST");
             mongoTemplate.insert(map, USER_COLLECTION);
         }
         return opaqueToken;
diff --git a/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/SecurityConfiguration.java b/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/SecurityConfiguration.java
index 2826610..9e0d347 100644
--- a/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/SecurityConfiguration.java
+++ b/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/SecurityConfiguration.java
@@ -7,14 +7,25 @@
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler;
+import org.springframework.security.access.expression.method.MethodSecurityExpressionHandler;
+import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
+import org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.authentication.AuthenticationManagerResolver;
 import org.springframework.security.config.Customizer;
+import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configurers.CsrfConfigurer;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper;
 import org.springframework.security.oauth2.core.DefaultOAuth2AuthenticatedPrincipal;
+import org.springframework.security.oauth2.core.oidc.user.OidcUserAuthority;
+import org.springframework.security.oauth2.core.user.OAuth2UserAuthority;
 import org.springframework.security.oauth2.server.resource.authentication.OpaqueTokenAuthenticationProvider;
+import org.springframework.security.oauth2.server.resource.introspection.BadOpaqueTokenException;
 import org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenIntrospector;
 import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.util.matcher.RequestMatcher;
@@ -22,31 +33,35 @@
 import org.springframework.web.cors.CorsConfigurationSource;
 import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
 
-import java.util.Arrays;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
+import java.util.*;
 
 @Configuration
 @EnableWebSecurity
+@EnableGlobalMethodSecurity(prePostEnabled = true)
 public class SecurityConfiguration {
-    private String user;
 
     @Autowired
     private OAuth2LoginSuccessHandler oAuth2LoginSuccessHandler;
 
     @Value("${custom.allowedCorsOrigins:}")
     private List<String> corsOrigins;
+
     @Bean
     public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
         http
                 .csrf(CsrfConfigurer::disable)
                 .cors(cors -> cors.configurationSource(corsConfigurationSource()))
-                .authorizeHttpRequests(ac -> ac.requestMatchers("/error")
-                        .permitAll().anyRequest().authenticated())
+                .authorizeHttpRequests(ac ->
+                        ac.requestMatchers("/error")
+                                .permitAll()
+//                                .requestMatchers("/api").hasRole("ADMIN")
+                                .anyRequest().authenticated())
                 .oauth2Login(oauth2 -> {
-                    oauth2.successHandler(oAuth2LoginSuccessHandler);
-                }).logout(Customizer.withDefaults());
+                    oauth2.userInfoEndpoint().userAuthoritiesMapper(userAuthoritiesMapper())
+                            .and()
+                            .successHandler(oAuth2LoginSuccessHandler);
+                })
+                .logout(Customizer.withDefaults());
         http.oauth2ResourceServer().authenticationManagerResolver(customAuthenticationManager());
         return http.build();
     }
@@ -81,12 +96,60 @@ public AuthenticationManager opaque() {
         OpaqueTokenIntrospector introspectionClient = token -> {
             Map userInfo = UserInfo.getUser(token);
             if (userInfo != null) {
-                return new DefaultOAuth2AuthenticatedPrincipal("user", Map.of("name", userInfo.get("name")), null);
-            }
-            else {
-                return null;
+                return new DefaultOAuth2AuthenticatedPrincipal("user", Map.of("name", userInfo.get("name")),
+                        List.of(new SimpleGrantedAuthority((String) userInfo.get("role"))));
+            } else {
+                throw new BadOpaqueTokenException("Invalid token " + token);
             }
         };
         return new OpaqueTokenAuthenticationProvider(introspectionClient)::authenticate;
     }
+
+    private GrantedAuthoritiesMapper userAuthoritiesMapper() {
+        return (authorities) -> {
+            Set<GrantedAuthority> mappedAuthorities = new HashSet<>();
+            authorities.forEach(authority -> {
+                Map userInfo = null;
+                if (authority.getAuthority().equals("OAUTH2_USER")) {
+                    userInfo = UserInfo.getUserBy("email", (String) ((OAuth2UserAuthority) authority).getAttributes().get("login") + "@github");
+
+                    if (userInfo != null && userInfo.get("role") != null) {
+                        GrantedAuthority ga = new SimpleGrantedAuthority((String) userInfo.get("role"));
+                        mappedAuthorities.add(ga);
+                    } else {
+                        GrantedAuthority ga = new SimpleGrantedAuthority("ROLE_GUEST");
+                        mappedAuthorities.add(ga);
+                    }
+                } else if (authority.getAuthority().equals("OIDC_USER")) {
+                    userInfo = UserInfo.getUserBy("email", (String) ((OidcUserAuthority) authority).getAttributes().get("email"));
+
+                    if (userInfo != null && userInfo.get("role") != null) {
+                        GrantedAuthority ga = new SimpleGrantedAuthority((String) userInfo.get("role"));
+                        mappedAuthorities.add(ga);
+                    } else {
+                        GrantedAuthority ga = new SimpleGrantedAuthority("ROLE_GUEST");
+                        mappedAuthorities.add(ga);
+                    }
+                } else {
+                    mappedAuthorities.add(authority);
+                }
+            });
+            return mappedAuthorities;
+        };
+    }
+
+    @Bean
+    static RoleHierarchy roleHierarchy() {
+        RoleHierarchyImpl hierarchy = new RoleHierarchyImpl();
+        hierarchy.setHierarchy("ROLE_ADMIN > ROLE_USER\n" +
+                "ROLE_USER > ROLE_GUEST");
+        return hierarchy;
+    }
+
+    @Bean
+    static MethodSecurityExpressionHandler methodSecurityExpressionHandler(RoleHierarchy roleHierarchy) {
+        DefaultMethodSecurityExpressionHandler expressionHandler = new DefaultMethodSecurityExpressionHandler();
+        expressionHandler.setRoleHierarchy(roleHierarchy);
+        return expressionHandler;
+    }
 }
diff --git a/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/ShareLinkController.java b/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/ShareLinkController.java
index 59dd242..f2651a7 100644
--- a/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/ShareLinkController.java
+++ b/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/ShareLinkController.java
@@ -15,6 +15,7 @@
 import org.springframework.data.mongodb.core.query.Query;
 import org.springframework.data.mongodb.core.query.Update;
 import org.springframework.http.HttpHeaders;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.oauth2.core.DefaultOAuth2AuthenticatedPrincipal;
@@ -25,9 +26,7 @@
 import org.springframework.web.bind.annotation.RestController;
 
 import java.time.LocalDateTime;
-import java.util.ArrayList;
 import java.util.List;
-import java.util.Map;
 import java.util.UUID;
 
 @RestController
@@ -45,6 +44,8 @@ public class ShareLinkController {
 
     @Autowired
     private MongoTemplate mongoTemplate;
+
+    @PreAuthorize("hasRole('USER')")
     @PostMapping("/create")
     public String create(@RequestBody String filePathOrDigest) {
         Authentication auth = SecurityContextHolder.getContext().getAuthentication();
@@ -73,6 +74,7 @@ public String create(@RequestBody String filePathOrDigest) {
         }
     }
 
+    @PreAuthorize("hasRole('GUEST')")
     @PostMapping("/verify")
     public DBObject verify(@RequestBody String shareId) {
         Query query = new Query(Criteria.where("shareId").is(shareId));
@@ -89,6 +91,7 @@ public DBObject verify(@RequestBody String shareId) {
         return (res.isEmpty() || res2 == null)? null : res2.get(0);
     }
 
+    @PreAuthorize("hasRole('GUEST')")
     @PostMapping("/downloadhistory")
     public Integer addDownloadHistory(@RequestBody String shareId, HttpServletRequest request, HttpServletResponse response) {
             Query query = new Query(Criteria.where("shareId").is(shareId));
diff --git a/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/StatisticsController.java b/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/StatisticsController.java
index 42bb5d4..cae3083 100644
--- a/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/StatisticsController.java
+++ b/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/controller/StatisticsController.java
@@ -8,6 +8,8 @@
 import org.springframework.data.mongodb.core.aggregation.AggregationResults;
 import org.springframework.data.mongodb.core.query.Criteria;
 import org.springframework.data.mongodb.core.query.Query;
+import org.springframework.security.access.annotation.Secured;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestParam;
@@ -27,6 +29,7 @@ public class StatisticsController {
     public final String METADATA_COLLECTION = "metadata";
     public final String DATASET_COLLECTION = "dataset";
 
+    @PreAuthorize("hasRole('USER')")
     @GetMapping("/stats/metadataBasic")
     public HashMap<String, Object> metadataBasic (@RequestParam("collectionName") String collectionName) {
         HashMap <String, Object> res = new HashMap<>();
diff --git a/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/util/UserInfo.java b/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/util/UserInfo.java
index afa38a9..054932d 100644
--- a/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/util/UserInfo.java
+++ b/wildfirestorage-spring/src/main/java/com/sjsu/wildfirestorage/spring/util/UserInfo.java
@@ -36,4 +36,13 @@ public static Map getUser (String token) {
         }
         return null;
     }
+
+    public static Map getUserBy (String key, String value) {
+        Query query = new Query(Criteria.where(key).is(value));
+        var opaqueTokenMap = mongoTemplate.find(query, Map.class, USER_COLLECTION);
+        if (!opaqueTokenMap.isEmpty()) {
+            return opaqueTokenMap.get(0);
+        }
+        return null;
+    }
 }