diff --git a/OliveTin.proto b/OliveTin.proto
index 7caf6c6..56484c9 100644
--- a/OliveTin.proto
+++ b/OliveTin.proto
@@ -209,6 +209,15 @@ message KillActionResponse {
 	bool found = 4;
 }
 
+message LocalUserLoginRequest {
+    string username = 1;
+    string password = 2;
+}
+
+message LocalUserLoginResponse {
+    string authenticated_user = 1;
+}
+
 service OliveTinApiService {
 	rpc GetDashboardComponents(GetDashboardComponentsRequest) returns (GetDashboardComponentsResponse) {
 		option (google.api.http) = {
@@ -298,4 +307,11 @@ service OliveTinApiService {
 			get: "/api/readyz"
 		};
 	}
+
+    rpc Authenticate(LocalUserLoginRequest) returns (LocalUserLoginResponse) {
+        option (google.api.http) = {
+            post: "/api/authenticate"
+            body: "*"
+        };
+    }
 }
diff --git a/internal/config/config.go b/internal/config/config.go
index 4280ba1..57f393e 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -115,6 +115,7 @@ type Config struct {
 	AuthJwtPubKeyPath               string // will read pub key from file on disk
 	AuthHttpHeaderUsername          string
 	AuthHttpHeaderUserGroup         string
+	AuthUsernamePassword            AuthUsernamePasswordConfig
 	AuthLoginUrl                    string
 	AuthAllowGuest                  bool
 	AuthOAuth2RedirectURL           string
@@ -139,6 +140,17 @@ type Config struct {
 	usedConfigDir string
 }
 
+type AuthUsernamePasswordConfig struct {
+	Enabled bool
+	Users   []*LocalUser
+}
+
+type LocalUser struct {
+	Username string
+	Password string
+	Groups   []string
+}
+
 type OAuth2Provider struct {
 	Name          string
 	Title         string
diff --git a/internal/grpcapi/grpcApi.go b/internal/grpcapi/grpcApi.go
index 743548e..ec73c8a 100644
--- a/internal/grpcapi/grpcApi.go
+++ b/internal/grpcapi/grpcApi.go
@@ -94,6 +94,19 @@ func (api *oliveTinAPI) StartAction(ctx ctx.Context, req *pb.StartActionRequest)
 	}, nil
 }
 
+func (api *oliveTinAPI) Authenticate(ctx ctx.Context, req *pb.LocalUserLoginRequest) (*pb.LocalUserLoginResponse, error) {
+/*
+	user := acl.Authenticate(cfg, req.Username, req.Password)
+
+	if user == nil {
+		return nil, status.Errorf(codes.Unauthenticated, "Invalid username or password.")
+	}
+*/
+
+	return &pb.LocalUserLoginResponse{
+	}, nil
+}
+
 func (api *oliveTinAPI) StartActionAndWait(ctx ctx.Context, req *pb.StartActionAndWaitRequest) (*pb.StartActionAndWaitResponse, error) {
 	args := make(map[string]string)
 
diff --git a/webui.dev/index.html b/webui.dev/index.html
index bd1bcdd..ba158b9 100644
--- a/webui.dev/index.html
+++ b/webui.dev/index.html
@@ -92,6 +92,35 @@
 				</fieldset>
 			</section>
 
+			<section id = "content-login" title = "Login" hidden>
+				<div class = "flex-col">
+				<form class = "box-shadow padded-content">
+					<h2>OAuth Login</h2>
+					<div>
+						<button>GitHub</button>
+						<button>Google</button>
+					</div>
+					<hr />
+					<h2>Local Login</h2>
+					<div class = "arguments">
+						<label for = "username">
+							<span>Username:</span>
+						</label>
+						<input type = "text" name = "username" />
+						<span></span>
+
+						<label for = "password">
+							<span>Password:</span>
+						</label>
+						<input type = "password" name = "password" />
+						<span></span>
+
+						<button type = "submit">Login</button>
+					</div>
+				</form>
+				</div>
+			</section>
+
 			<noscript>
 				<div class = "error">Sorry, JavaScript is required to use OliveTin.</div>
 			</noscript>