diff --git a/cmd/climc/shell/identity/domains.go b/cmd/climc/shell/identity/domains.go
index e0cf0e0b7e..713c07fe9a 100644
--- a/cmd/climc/shell/identity/domains.go
+++ b/cmd/climc/shell/identity/domains.go
@@ -156,4 +156,16 @@ func init() {
 		return nil
 	})
 
+	type DomainUnlinkIdpOptions struct {
+		DOMAIN string `help:"ID or name of domain to operate" json:"-"`
+	}
+	R(&DomainUnlinkIdpOptions{}, "domain-unlink-idp", "Unlink domain from an entity in the speicified identity provider", func(s *mcclient.ClientSession, args *DomainUnlinkIdpOptions) error {
+		result, err := modules.Domains.PerformAction(s, args.DOMAIN, "unlink-idp", nil)
+		if err != nil {
+			return err
+		}
+		printObject(result)
+		return nil
+	})
+
 }
diff --git a/pkg/apis/const.go b/pkg/apis/const.go
index 5cfc99001c..df656d964f 100644
--- a/pkg/apis/const.go
+++ b/pkg/apis/const.go
@@ -42,3 +42,21 @@ const (
 	SERVICE_TYPE_ETCD     = "etcd"
 	SERVICE_TYPE_INFLUXDB = "influxdb"
 )
+
+var (
+	NO_RESOURCE_SERVICES = []string{
+		SERVICE_TYPE_OFFLINE_CLOUDMETA,
+		SERVICE_TYPE_CLOUDMETA,
+		SERVICE_TYPE_WEBSOCKET,
+		SERVICE_TYPE_AUTOUPDATE,
+		SERVICE_TYPE_YUNIONAGENT,
+		SERVICE_TYPE_SCHEDULER,
+		SERVICE_TYPE_ITSM,
+		SERVICE_TYPE_VNCPROXY,
+		SERVICE_TYPE_KEYSTONE,
+		SERVICE_TYPE_CLOUDWATCHER,
+		SERVICE_TYPE_SERVICETREE,
+		SERVICE_TYPE_ETCD,
+		SERVICE_TYPE_INFLUXDB,
+	}
+)
diff --git a/pkg/keystone/cronjobs/project_resources.go b/pkg/keystone/cronjobs/project_resources.go
index 5d5625a2af..69a52de697 100644
--- a/pkg/keystone/cronjobs/project_resources.go
+++ b/pkg/keystone/cronjobs/project_resources.go
@@ -23,6 +23,7 @@ import (
 	"yunion.io/x/jsonutils"
 	"yunion.io/x/log"
 	"yunion.io/x/pkg/errors"
+	"yunion.io/x/pkg/utils"
 
 	"yunion.io/x/onecloud/pkg/apis"
 	api "yunion.io/x/onecloud/pkg/apis/identity"
@@ -65,7 +66,7 @@ func refreshScopeResourceCount(ctx context.Context) error {
 	}
 	serviceTbl := make(map[string]*sServiceEndpoints)
 	for _, ep := range eps {
-		if ep.ServiceType == apis.SERVICE_TYPE_KEYSTONE || ep.ServiceType == apis.SERVICE_TYPE_OFFLINE_CLOUDMETA {
+		if utils.IsInStringArray(ep.ServiceType, apis.NO_RESOURCE_SERVICES) {
 			// skip self and offline cloudmeta
 			continue
 		}
diff --git a/pkg/keystone/models/domains.go b/pkg/keystone/models/domains.go
index 57198da3c8..e069705d40 100644
--- a/pkg/keystone/models/domains.go
+++ b/pkg/keystone/models/domains.go
@@ -530,3 +530,34 @@ func (manager *SDomainManager) ValidateCreateData(
 
 	return input, nil
 }
+
+func (domain *SDomain) AllowPerformUnlinkIdp(
+	ctx context.Context,
+	userCred mcclient.TokenCredential,
+	query jsonutils.JSONObject,
+	input api.UserUnlinkIdpInput,
+) bool {
+	return db.IsAdminAllowPerform(userCred, domain, "unlink-idp")
+}
+
+// domain和IDP的指定entityId解除关联
+func (domain *SDomain) PerformUnlinkIdp(
+	ctx context.Context,
+	userCred mcclient.TokenCredential,
+	query jsonutils.JSONObject,
+	input api.UserUnlinkIdpInput,
+) (jsonutils.JSONObject, error) {
+	mapping, err := domain.getIdmapping()
+	if err != nil {
+		if errors.Cause(err) == sql.ErrNoRows {
+			return nil, nil
+		} else {
+			return nil, errors.Wrap(err, "domain.getIdmapping")
+		}
+	}
+	err = domain.UnlinkIdp(mapping.IdpId)
+	if err != nil {
+		return nil, errors.Wrap(err, "domain.UnlinkIdp")
+	}
+	return nil, nil
+}