diff --git a/pkg/mcclient/modules/mod_domains.go b/pkg/mcclient/modules/mod_domains.go
index 81f1d10345..84d57ffb34 100644
--- a/pkg/mcclient/modules/mod_domains.go
+++ b/pkg/mcclient/modules/mod_domains.go
@@ -5,6 +5,7 @@ import (
 
 	"yunion.io/x/jsonutils"
 	"yunion.io/x/log"
+	"yunion.io/x/onecloud/pkg/httperrors"
 	"yunion.io/x/onecloud/pkg/util/httputils"
 
 	"yunion.io/x/onecloud/pkg/mcclient"
@@ -233,19 +234,25 @@ func (this *DomainManager) DoDomainConfigDelete(s *mcclient.ClientSession, param
 		params := jsonutils.NewDict()
 		params.Add(jsonutils.NewString(objId), "domain_id")
 
-		result, err := UsersV3.List(s, params)
-
+		detail, err := this.GetById(s, domain, nil)
 		if err != nil {
-			log.Errorf("user list got error: %v", err)
+			log.Errorf("got domain detail error: %v", err)
+			return ret, httperrors.NewResourceNotFoundError("找不到该认证域")
 		}
 
-		if len(result.Data) > 0 {
-			e := httputils.JSONClientError{
-				Code:    403,
-				Class:   "",
-				Details: fmt.Sprintf("域名%s下存在%d名用户,不允许删除.", objId, len(result.Data)),
+		driver, err := detail.GetString("driver")
+		if err != nil {
+			log.Errorf("got driver from domain detail error: %v", err)
+			return ret, httperrors.NewInternalServerError("服务器错误,获取认证协议失败,不允许删除")
+		}
+
+		if driver != "ldap" {
+			if result, err := UsersV3.List(s, params); err != nil {
+				log.Errorf("user list got error: %v", err)
+				return ret, httperrors.NewInternalServerError("服务器错误,获取认证域用户列表失败,不允许删除")
+			} else if len(result.Data) > 0 {
+				return ret, httperrors.NewForbiddenError(fmt.Sprintf("域名%s下存在%d名用户,不允许删除.", objId, len(result.Data)))
 			}
-			return ret, &e
 		}
 
 		this.DeleteConfig(s, objId)