diff --git a/action.go b/action.go
index dcc0776..cd9d2b3 100644
--- a/action.go
+++ b/action.go
@@ -64,6 +64,11 @@ func (s Service) GetAllUsers(query model.UserAllQuery) model.UserAll {
 	return user.All(query)
 }
 
+// GetUsersByPermission ...
+func (s Service) GetUsersByPermission(query model.UserByPermissionQuery) model.UserAll {
+	return user.GetUsersByPermission(query)
+}
+
 // CountAllUsers ...
 func (s Service) CountAllUsers(query model.UserCountQuery) int64 {
 	return user.Count(query)
diff --git a/model/query.go b/model/query.go
index 8f3fb87..fec215a 100644
--- a/model/query.go
+++ b/model/query.go
@@ -17,6 +17,7 @@ type CommonQuery struct {
 	Deleted string
 	Sort    interface{}
 	Other   map[string]interface{}
+	RoleIDs []primitive.ObjectID
 }
 
 // AssignDeleted ...
@@ -45,6 +46,17 @@ func (q *CommonQuery) AssignRoleID(cond bson.M) {
 	}
 }
 
+// AssignRoleIDs ...
+func (q *CommonQuery) AssignRoleIDs(cond bson.M) {
+	if len(q.RoleIDs) == 1 {
+		cond["roleId"] = q.RoleIDs[0]
+	} else if len(q.RoleIDs) > 1 {
+		cond["roleId"] = bson.M{
+			"$in": q.RoleIDs,
+		}
+	}
+}
+
 // AssignStatus ...
 func (q *CommonQuery) AssignStatus(cond bson.M) {
 	if q.Status != "" {
diff --git a/model/user_request.go b/model/user_request.go
index d7a8435..bd7c645 100644
--- a/model/user_request.go
+++ b/model/user_request.go
@@ -48,6 +48,18 @@ type UserAllQuery struct {
 	Cond    bson.M
 }
 
+// UserByPermissionQuery ...
+type UserByPermissionQuery struct {
+	Page       int64
+	Limit      int64
+	Keyword    string
+	Status     string
+	Permission string // permission code
+	Sort       interface{}
+	Other      map[string]interface{} // query fields in other object
+	Cond       bson.M
+}
+
 // UserCountQuery ...
 type UserCountQuery struct {
 	RoleID string
@@ -163,3 +175,16 @@ func (co ChangePasswordOptions) Validate() error {
 
 	return nil
 }
+
+// Validate ...
+func (q UserByPermissionQuery) Validate() error {
+	// OldPassword, NewPassword
+	if q.Permission == "" {
+		logger.Error("usermngmt - User - GetUsersByPermission : invalid permission", logger.LogData{
+			"payload": q,
+		})
+		return errors.New(internal.ErrorInvalidPermission)
+	}
+
+	return nil
+}
diff --git a/user/db.go b/user/db.go
index 0339f20..1411051 100644
--- a/user/db.go
+++ b/user/db.go
@@ -79,6 +79,33 @@ func roleFindByID(ctx context.Context, id primitive.ObjectID) (model.DBRole, err
 	return doc, err
 }
 
+func permissionFindByCondition(ctx context.Context, cond interface{}, opts ...*options.FindOptions) (docs []model.DBPermission) {
+	var (
+		col = database.GetPermissionCol()
+	)
+	docs = make([]model.DBPermission, 0)
+
+	cursor, err := col.Find(ctx, cond, opts...)
+	if err != nil {
+		logger.Error("usermngmt - Permission - Find", logger.LogData{
+			"cond": cond,
+			"opts": opts,
+			"err":  err.Error(),
+		})
+		return
+	}
+	defer cursor.Close(ctx)
+	if err = cursor.All(ctx, &docs); err != nil {
+		logger.Error("usermngmt - Permission - Decode", logger.LogData{
+			"cond": cond,
+			"opts": opts,
+			"err":  err.Error(),
+		})
+		return
+	}
+	return
+}
+
 // permissionCountByCondition ...
 func permissionCountByCondition(ctx context.Context, cond interface{}) int64 {
 	var (
diff --git a/user/handle.go b/user/handle.go
index 20a6ee0..558bba7 100644
--- a/user/handle.go
+++ b/user/handle.go
@@ -203,6 +203,74 @@ func All(queryParams model.UserAllQuery) (r model.UserAll) {
 	return
 }
 
+// GetUsersByPermission ...
+func GetUsersByPermission(queryParams model.UserByPermissionQuery) (r model.UserAll) {
+	var (
+		ctx   = context.Background()
+		wg    sync.WaitGroup
+		cond  = bson.M{}
+		roles = make([]primitive.ObjectID, 0)
+	)
+	// Validate query
+	if err := queryParams.Validate(); err != nil {
+		return
+	}
+
+	if queryParams.Cond != nil {
+		cond = queryParams.Cond
+	}
+
+	// Get role by permission
+	permissions := permissionFindByCondition(ctx, bson.M{"code": queryParams.Permission})
+	for _, value := range permissions {
+		roles = append(roles, value.RoleID)
+	}
+	if len(roles) < 0 {
+		return
+	}
+
+	query := model.CommonQuery{
+		Page:    queryParams.Page,
+		Limit:   queryParams.Limit,
+		Keyword: queryParams.Keyword,
+		Status:  queryParams.Status,
+		Sort:    queryParams.Sort,
+		Other:   queryParams.Other,
+		RoleIDs: roles,
+	}
+
+	// Assign condition
+	query.SetDefaultLimit()
+	query.AssignKeyword(cond)
+	query.AssignRoleIDs(cond)
+	query.AssignStatus(cond)
+	query.AssignDeleted(cond)
+	query.AssignOther(cond)
+	cond["deleted"] = false
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		docs := findByCondition(ctx, cond, query.GetFindOptionsUsingPage())
+		res := make([]model.User, 0)
+		for _, doc := range docs {
+			res = append(res, getResponse(ctx, doc))
+		}
+		r.List = res
+	}()
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		r.Total = countByCondition(ctx, cond)
+	}()
+
+	wg.Wait()
+
+	r.Limit = query.Limit
+	return
+}
+
 // Count  ...
 func Count(queryParams model.UserCountQuery) int64 {
 	var (