Index: lams_central/src/java/org/lamsfoundation/lams/webservice/UserRoleServlet.java
===================================================================
diff -u
--- lams_central/src/java/org/lamsfoundation/lams/webservice/UserRoleServlet.java	(revision 0)
+++ lams_central/src/java/org/lamsfoundation/lams/webservice/UserRoleServlet.java	(revision 5d05b2b8e46cb54fdd3fb9658ee83913fd0ab366)
@@ -0,0 +1,111 @@
+package org.lamsfoundation.lams.webservice;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.log4j.Logger;
+import org.lamsfoundation.lams.integration.ExtServerOrgMap;
+import org.lamsfoundation.lams.integration.ExtUserUseridMap;
+import org.lamsfoundation.lams.integration.security.Authenticator;
+import org.lamsfoundation.lams.integration.service.IntegrationService;
+import org.lamsfoundation.lams.usermanagement.Organisation;
+import org.lamsfoundation.lams.usermanagement.Role;
+import org.lamsfoundation.lams.usermanagement.User;
+import org.lamsfoundation.lams.usermanagement.service.IUserManagementService;
+import org.lamsfoundation.lams.util.CentralConstants;
+import org.lamsfoundation.lams.web.util.AttributeNames;
+import org.springframework.web.context.support.WebApplicationContextUtils;
+
+/**
+ * Allows user role granting for integrated environments.
+ *
+ * @author Marcin Cieslak
+ *
+ */
+public class UserRoleServlet extends HttpServlet {
+
+    private static Logger log = Logger.getLogger(UserRoleServlet.class);
+
+    private static IntegrationService integrationService = null;
+    private static IUserManagementService userManagementService = null;
+
+    @Override
+    public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException {
+	String serverId = request.getParameter(CentralConstants.PARAM_SERVER_ID);
+	String datetime = request.getParameter(CentralConstants.PARAM_DATE_TIME);
+	String hashValue = request.getParameter(CentralConstants.PARAM_HASH_VALUE);
+	String username = request.getParameter(CentralConstants.PARAM_USERNAME);
+
+	try {
+	    ExtServerOrgMap serverMap = UserRoleServlet.integrationService.getExtServerOrgMap(serverId);
+	    Authenticator.authenticate(serverMap, datetime, username, hashValue);
+	    ExtUserUseridMap userMap = UserRoleServlet.integrationService.getExtUserUseridMap(serverMap, username);
+	    String method = request.getParameter(CentralConstants.PARAM_METHOD);
+	    String role = request.getParameter(AttributeNames.PARAM_ROLE);
+	    if ("grant".equalsIgnoreCase(method)) {
+		grant(userMap.getUser(), role);
+	    } else if ("revoke".equalsIgnoreCase(method)) {
+		revoke(userMap.getUser(), role);
+	    } else {
+		log.error("Unknown method: " + method);
+		response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Unknown method: " + method);
+	    }
+	} catch (Exception e) {
+	    UserRoleServlet.log.error("Error while setting user roles", e);
+	    response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "Error while setting user roles");
+	}
+    }
+
+    @Override
+    public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
+	doGet(request, response);
+    }
+
+    /**
+     * Initialization of the servlet.
+     */
+    @Override
+    public void init() throws ServletException {
+	UserRoleServlet.integrationService = (IntegrationService) WebApplicationContextUtils
+		.getRequiredWebApplicationContext(getServletContext()).getBean("integrationService");
+	UserRoleServlet.userManagementService = (IUserManagementService) WebApplicationContextUtils
+		.getRequiredWebApplicationContext(getServletContext()).getBean("userManagementService");
+    }
+
+    /**
+     * It only supports SYSADMIN role now, but can be extended in the future.
+     */
+    private void grant(User user, String role) throws IOException {
+	switch (role) {
+	    case Role.SYSADMIN:
+		Organisation rootOrganisation = userManagementService.getRootOrganisation();
+		List<String> roles = new ArrayList<String>(Arrays.asList(Role.ROLE_SYSADMIN.toString()));
+		userManagementService.setRolesForUserOrganisation(user, rootOrganisation.getOrganisationId(), roles);
+		break;
+	    default:
+		throw new IOException("Unknown role: " + role);
+	}
+    }
+
+    /**
+     * It only supports SYSADMIN role now, but can be extended in the future.
+     */
+    private void revoke(User user, String role) throws IOException {
+	switch (role) {
+	    case Role.SYSADMIN:
+		Organisation rootOrganisation = userManagementService.getRootOrganisation();
+		List<String> roles = new ArrayList<String>();
+		userManagementService.setRolesForUserOrganisation(user, rootOrganisation.getOrganisationId(), roles);
+		break;
+	    default:
+		throw new IOException("Unknown role: " + role);
+	}
+    }
+}
\ No newline at end of file
Index: lams_central/web/WEB-INF/web.xml
===================================================================
diff -u -rbca83628ffa34dcc98176b117aa5ff26d166300f -r5d05b2b8e46cb54fdd3fb9658ee83913fd0ab366
--- lams_central/web/WEB-INF/web.xml	(.../web.xml)	(revision bca83628ffa34dcc98176b117aa5ff26d166300f)
+++ lams_central/web/WEB-INF/web.xml	(.../web.xml)	(revision 5d05b2b8e46cb54fdd3fb9658ee83913fd0ab366)
@@ -374,7 +374,15 @@
 			org.lamsfoundation.lams.webservice.xml.NotificationServlet
 		</servlet-class>
 	</servlet>
-
+	
+	<servlet>
+		<servlet-name>UserRoleServlet</servlet-name>
+		<servlet-class>
+			org.lamsfoundation.lams.webservice.UserRoleServlet
+		</servlet-class>
+	</servlet>
+	
+	
 	<servlet-mapping>
 		<servlet-name>LearningDesignRestServlet</servlet-name>
 		<url-pattern>/rest/LearningDesign</url-pattern>
@@ -484,7 +492,11 @@
 		<servlet-name>NotificationServlet</servlet-name>
 		<url-pattern>/services/xml/NotificationManager</url-pattern>
 	</servlet-mapping>
-
+	<servlet-mapping>
+		<servlet-name>UserRoleServlet</servlet-name>
+		<url-pattern>/services/UserRoleManager</url-pattern>
+	</servlet-mapping>
+	
 	<mime-mapping>
 		<extension>csv</extension>
 		<mime-type>text/plain</mime-type>
@@ -622,6 +634,7 @@
 			<url-pattern>/services/getServerTime</url-pattern>
 			<url-pattern>/services/Register/*</url-pattern>
 			<url-pattern>/services/xml/NotificationManager</url-pattern>
+			<url-pattern>/services/UserRoleManager</url-pattern>
 			<url-pattern>/ForgotPasswordRequest</url-pattern>
 			<url-pattern>/forgotPassword.jsp</url-pattern>
 			<url-pattern>/forgotPasswordChange.jsp</url-pattern>