diff --git a/src/views/apps.html b/src/views/apps.html
index a99057bd8..6f63c1f91 100644
--- a/src/views/apps.html
+++ b/src/views/apps.html
@@ -90,6 +90,31 @@
             <tag-input class="form-control" placeholder="{{ 'app.display.tagsPlaceholder' | tr }}" taglist="applinksEdit.tags" name="tags" uib-tooltip="{{ 'app.display.tagsTooltip' | tr }}"></tag-input>
           </div>
 
+          <div class="radio">
+            <label>
+              <input type="radio" ng-model="applinksEdit.accessRestrictionOption" value="any">
+              <span>{{ 'app.accessControl.userManagement.visibleForAllUsers' | tr }}</span>
+            </label>
+          </div>
+          <div class="radio">
+            <label>
+              <input type="radio" ng-model="applinksEdit.accessRestrictionOption" value="groups">
+              <span>{{ 'app.accessControl.userManagement.visibleForSelected' | tr }}</span>
+              <span class="label label-danger" ng-show="applinksEdit.accessRestrictionOption === 'groups' && !applinksEdit.isAccessRestrictionValid()">{{ 'appstore.installDialog.errorUserManagementSelectAtLeastOne' | tr }}</span>
+            </label>
+          </div>
+          <div>
+            <div style="margin-left: 20px;">
+              <div class="display: inline-block">
+                {{ 'appstore.installDialog.users' | tr }}: <multiselect name="accessUsersSelect" class="input-sm stretch" ng-model="applinksEdit.accessRestriction.users" ng-disabled="applinksEdit.accessRestrictionOption !== 'groups'" options="(user.username || user.email)  for user in allUsers" data-multiple="true" filter-after-rows="5" scroll-after-rows="10"></multiselect>
+              </div>
+
+              <div class="">
+                {{ 'appstore.installDialog.groups' | tr }}: <multiselect name="accessGroupsSelect" class="input-sm stretch" ng-model="applinksEdit.accessRestriction.groups" ng-disabled="applinksEdit.accessRestrictionOption !== 'groups'" options="group.name for group in allGroups" data-multiple="true" filter-after-rows="5" scroll-after-rows="10"></multiselect>
+              </div>
+            </div>
+          </div>
+
           <input class="ng-hide" type="submit" ng-disabled="applinksEditForm.$invalid || applinksEdit.busyEdit || applinks.busyRemove"/>
         </form>
       </div>
diff --git a/src/views/apps.js b/src/views/apps.js
index 57822a170..23b85f1ac 100644
--- a/src/views/apps.js
+++ b/src/views/apps.js
@@ -27,6 +27,9 @@ angular.module('Application').controller('AppsController', ['$scope', '$translat
     $scope.appSearch = '';
     $scope.groups = [ GROUP_ACCESS_UNSET ];
 
+    $scope.allUsers = [];
+    $scope.allGroups = [];
+
     $translate(['apps.stateFilterHeader', 'apps.domainsFilterHeader', 'apps.groupsFilterHeader', 'app.states.running', 'app.states.stopped', 'app.states.notResponding', 'app.states.updateAvailable']).then(function (tr) {
         if (tr['apps.domainsFilterHeader']) ALL_DOMAINS_DOMAIN.domain = tr['apps.domainsFilterHeader'];
         if (tr['apps.groupsFilterHeader']) GROUP_ACCESS_UNSET.name = tr['apps.groupsFilterHeader'];
@@ -95,6 +98,8 @@ angular.module('Application').controller('AppsController', ['$scope', '$translat
         upstreamUri: '',
         label: '',
         tags: '',
+        accessRestrictionOption: 'any',
+        accessRestriction: { users: [], groups: [] },
 
         show: function () {
             $scope.applinksAdd.error = {};
@@ -116,9 +121,17 @@ angular.module('Application').controller('AppsController', ['$scope', '$translat
 
             $scope.applinksAdd.busy = true;
 
+            var accessRestriction = null;
+            if ($scope.applinksAdd.accessRestrictionOption === 'groups') {
+                accessRestriction = { users: [], groups: [] };
+                accessRestriction.users = $scope.applinksAdd.accessRestriction.users.map(function (u) { return u.id; });
+                accessRestriction.groups = $scope.applinksAdd.accessRestriction.groups.map(function (g) { return g.id; });
+            }
+
             var data = {
                 upstreamUri: $scope.applinksAdd.upstreamUri,
                 label: $scope.applinksAdd.label,
+                accessRestriction: accessRestriction,
                 tags: $scope.applinksAdd.tags.split(' ').map(function (t) { return t.trim(); }).filter(function (t) { return !!t; })
             };
 
@@ -142,6 +155,13 @@ angular.module('Application').controller('AppsController', ['$scope', '$translat
         upstreamUri: '',
         label: '',
         tags: '',
+        accessRestrictionOption: '',
+        accessRestriction: { users: [], groups: [] },
+
+        isAccessRestrictionValid: function () {
+            var tmp = $scope.applinksEdit.accessRestriction;
+            return !!(tmp.users.length || tmp.groups.length);
+        },
 
         show: function (applink) {
             $scope.applinksEdit.error = {};
@@ -150,6 +170,19 @@ angular.module('Application').controller('AppsController', ['$scope', '$translat
             $scope.applinksEdit.id = applink.id;
             $scope.applinksEdit.upstreamUri = applink.upstreamUri;
             $scope.applinksEdit.label = applink.label;
+            $scope.applinksEdit.accessRestrictionOption = applink.accessRestriction ? 'groups' : 'any';
+            $scope.applinksEdit.accessRestriction = { users: [], groups: [] };
+
+            var userSet, groupSet;
+            if (applink.accessRestriction) {
+                userSet = {};
+                applink.accessRestriction.users.forEach(function (uid) { userSet[uid] = true; });
+                $scope.allUsers.forEach(function (u) { if (userSet[u.id] === true) $scope.applink.accessRestriction.users.push(u); });
+
+                groupSet = {};
+                if (applink.accessRestriction.groups) applink.accessRestriction.groups.forEach(function (gid) { groupSet[gid] = true; });
+                $scope.allGroups.forEach(function (g) { if (groupSet[g.id] === true) $scope.applink.accessRestriction.groups.push(g); });
+            }
 
             // translate for tag-input
             $scope.applinksEdit.tags = applink.tags ? applink.tags.join(' ') : '';
@@ -165,9 +198,17 @@ angular.module('Application').controller('AppsController', ['$scope', '$translat
         submit: function () {
             $scope.applinksEdit.busyEdit = true;
 
+            var accessRestriction = null;
+            if ($scope.applinksEdit.accessRestrictionOption === 'groups') {
+                accessRestriction = { users: [], groups: [] };
+                accessRestriction.users = $scope.applinksEdit.accessRestriction.users.map(function (u) { return u.id; });
+                accessRestriction.groups = $scope.applinksEdit.accessRestriction.groups.map(function (g) { return g.id; });
+            }
+
             var data = {
                 upstreamUri: $scope.applinksEdit.upstreamUri,
                 label: $scope.applinksEdit.label,
+                accessRestriction: accessRestriction,
                 tags: $scope.applinksEdit.tags.split(' ').map(function (t) { return t.trim(); }).filter(function (t) { return !!t; })
             };
 
@@ -230,6 +271,7 @@ angular.module('Application').controller('AppsController', ['$scope', '$translat
             if (error) Client.error(error);
 
             $scope.groups = [ GROUP_ACCESS_UNSET ].concat(result);
+            $scope.allGroups = result;
 
             if (localStorage.selectedGroup) $scope.selectedGroup = $scope.groups.find(function (g) { return g.id === localStorage.selectedGroup; }) || GROUP_ACCESS_UNSET;
         });
@@ -242,6 +284,12 @@ angular.module('Application').controller('AppsController', ['$scope', '$translat
 
             if (localStorage.selectedDomain) $scope.selectedDomain = $scope.filterDomains.find(function (d) { return d.domain === localStorage.selectedDomain; }) || ALL_DOMAINS_DOMAIN;
         });
+
+        Client.getAllUsers(function (error, users) {
+            if (error) Client.error(error);
+
+            $scope.allUsers = users;
+        });
     });
 
     // setup all the dialog focus handling