diff --git a/pkg/apigateway/handler/auth.go b/pkg/apigateway/handler/auth.go
index e2210a01a3..3b0d78c69b 100644
--- a/pkg/apigateway/handler/auth.go
+++ b/pkg/apigateway/handler/auth.go
@@ -16,6 +16,7 @@ package handler
 
 import (
 	"context"
+	"encoding/base64"
 	"fmt"
 	"net/http"
 	"strings"
@@ -269,6 +270,10 @@ func (h *AuthHandlers) doCredentialLogin(ctx context.Context, req *http.Request,
 		if err != nil {
 			return nil, httperrors.NewInputParameterError("get password in body")
 		}
+		// try base64 decryption
+		if decPasswd, err := base64.StdEncoding.DecodeString(passwd); err == nil {
+			passwd = string(decPasswd)
+		}
 		if len(uname) == 0 || len(passwd) == 0 {
 			return nil, httperrors.NewInputParameterError("username or password is empty")
 		}
@@ -533,14 +538,6 @@ func FetchRegion(req *http.Request) string {
 	return ""
 }
 
-func fetchDomain(req *http.Request) string {
-	r, e := req.Cookie("domain")
-	if e != nil {
-		return ""
-	}
-	return r.Value
-}
-
 type role struct {
 	id   string
 	name string
diff --git a/pkg/apis/compute/cloudaccount.go b/pkg/apis/compute/cloudaccount.go
index 9dbc9ad83a..6d15a1b4f4 100644
--- a/pkg/apis/compute/cloudaccount.go
+++ b/pkg/apis/compute/cloudaccount.go
@@ -167,10 +167,11 @@ type CloudaccountCreateInput struct {
 	IsOnPremise bool
 
 	// 指定云账号所属的项目
-	Tenant string `json:"tenant"`
-
+	// Tenant string `json:"tenant"`
 	// swagger:ignore
-	TenantId string
+	// TenantId string
+
+	apis.ProjectizedResourceInput
 
 	// 启用自动同步
 	// default: false
diff --git a/pkg/apis/identity/input.go b/pkg/apis/identity/input.go
index 6134a36114..ccffe229f9 100644
--- a/pkg/apis/identity/input.go
+++ b/pkg/apis/identity/input.go
@@ -23,6 +23,7 @@ import (
 
 type IdentityBaseResourceCreateInput struct {
 	apis.StandaloneResourceCreateInput
+	apis.DomainizedResourceCreateInput
 }
 
 type EnabledIdentityBaseResourceCreateInput struct {
diff --git a/pkg/apis/identity/zz_generated.model.go b/pkg/apis/identity/zz_generated.model.go
index 4cca069fb9..dabaedf6e4 100644
--- a/pkg/apis/identity/zz_generated.model.go
+++ b/pkg/apis/identity/zz_generated.model.go
@@ -55,12 +55,11 @@ type SCredential struct {
 // SDomain is an autogenerated struct via yunion.io/x/onecloud/pkg/keystone/models.SDomain.
 type SDomain struct {
 	apis.SStandaloneResourceBase
-	Extra       interface{} `json:"extra"`
-	Enabled     *bool       `json:"enabled,omitempty"`
-	IsDomain    *bool       `json:"is_domain,omitempty"`
-	DomainId    string      `json:"domain_id"`
-	ParentId    string      `json:"parent_id"`
-	Displayname string      `json:"displayname"`
+	Extra    interface{} `json:"extra"`
+	Enabled  *bool       `json:"enabled,omitempty"`
+	IsDomain *bool       `json:"is_domain,omitempty"`
+	DomainId string      `json:"domain_id"`
+	ParentId string      `json:"parent_id"`
 }
 
 // SEnabledIdentityBaseResource is an autogenerated struct via yunion.io/x/onecloud/pkg/keystone/models.SEnabledIdentityBaseResource.
@@ -164,9 +163,8 @@ type SPolicy struct {
 // SProject is an autogenerated struct via yunion.io/x/onecloud/pkg/keystone/models.SProject.
 type SProject struct {
 	SIdentityBaseResource
-	ParentId    string `json:"parent_id"`
-	IsDomain    *bool  `json:"is_domain,omitempty"`
-	Displayname string `json:"displayname"`
+	ParentId string `json:"parent_id"`
+	IsDomain *bool  `json:"is_domain,omitempty"`
 }
 
 // SRegion is an autogenerated struct via yunion.io/x/onecloud/pkg/keystone/models.SRegion.
diff --git a/pkg/apis/monitor/zz_generated.model.go b/pkg/apis/monitor/zz_generated.model.go
index cb89273b8d..d75e90b2f5 100644
--- a/pkg/apis/monitor/zz_generated.model.go
+++ b/pkg/apis/monitor/zz_generated.model.go
@@ -88,14 +88,19 @@ type SSuggestSysAlert struct {
 	apis.SVirtualResourceBase
 	apis.SEnabledResourceBase
 	// 监控规则对应的json对象
+	RuleName      string      `json:"rule_name"`
 	MonitorConfig interface{} `json:"monitor_config"`
 	// 监控规则type：Rule Type
 	Type    string      `json:"type"`
 	ResMeta interface{} `json:"res_meta"`
 	Problem interface{} `json:"problem"`
-	Suggest string      `json:"suggest"`
-	Action  string      `json:"action"`
-	ResId   string      `json:"res_id"`
+	// Suggest string               `width:"256"  list:"user" update:"user"`
+	Action       string `json:"action"`
+	ResId        string `json:"res_id"`
+	CloudEnv     string `json:"cloud_env"`
+	Provider     string `json:"provider"`
+	Project      string `json:"project"`
+	Cloudaccount string `json:"cloudaccount"`
 }
 
 // SSuggestSysRule is an autogenerated struct via yunion.io/x/onecloud/pkg/monitor/models.SSuggestSysRule.
diff --git a/pkg/cloudcommon/db/domain.go b/pkg/cloudcommon/db/domain.go
index e86c3e6c90..36989b8da9 100644
--- a/pkg/cloudcommon/db/domain.go
+++ b/pkg/cloudcommon/db/domain.go
@@ -16,8 +16,10 @@ package db
 
 import (
 	"context"
+	"database/sql"
 
 	"yunion.io/x/jsonutils"
+	"yunion.io/x/pkg/errors"
 	"yunion.io/x/pkg/util/reflectutils"
 	"yunion.io/x/sqlchemy"
 
@@ -163,3 +165,16 @@ func (manager *SDomainizedResourceBaseManager) FetchCustomizeColumns(
 	}
 	return ret
 }
+
+func ValidateDomainizedResourceInput(ctx context.Context, input apis.DomainizedResourceInput) (*STenant, apis.DomainizedResourceInput, error) {
+	domain, err := DefaultDomainFetcher(ctx, input.ProjectDomain)
+	if err != nil {
+		if errors.Cause(err) == sql.ErrNoRows {
+			return nil, input, httperrors.NewResourceNotFoundError2("domain", input.ProjectDomain)
+		} else {
+			return nil, input, errors.Wrap(err, "TenantCacheManager.FetchDomainByIdOrName")
+		}
+	}
+	input.ProjectDomain = domain.GetId()
+	return domain, input, nil
+}
diff --git a/pkg/cloudcommon/db/project.go b/pkg/cloudcommon/db/project.go
index 77091ef3fb..3bb4723a0a 100644
--- a/pkg/cloudcommon/db/project.go
+++ b/pkg/cloudcommon/db/project.go
@@ -16,6 +16,7 @@ package db
 
 import (
 	"context"
+	"database/sql"
 	"time"
 
 	"yunion.io/x/jsonutils"
@@ -197,3 +198,16 @@ func fetchProjects(ctx context.Context, projectIds []string, isDomain bool) map[
 	}
 	return ret
 }
+
+func ValidateProjectizedResourceInput(ctx context.Context, input apis.ProjectizedResourceInput) (*STenant, apis.ProjectizedResourceInput, error) {
+	tenant, err := DefaultProjectFetcher(ctx, input.Project)
+	if err != nil {
+		if errors.Cause(err) == sql.ErrNoRows {
+			return nil, input, httperrors.NewResourceNotFoundError2("project", input.Project)
+		} else {
+			return nil, input, errors.Wrap(err, "TenantCacheManager.FetchTenantByIdOrName")
+		}
+	}
+	input.Project = tenant.GetId()
+	return tenant, input, nil
+}
diff --git a/pkg/compute/models/cloudaccounts.go b/pkg/compute/models/cloudaccounts.go
index ed00b1abb0..27ef16984c 100644
--- a/pkg/compute/models/cloudaccounts.go
+++ b/pkg/compute/models/cloudaccounts.go
@@ -342,15 +342,11 @@ func (manager *SCloudaccountManager) ValidateCreateData(
 		return input, err
 	}
 
-	if len(input.Tenant) > 0 {
-		tenantObj, err := db.TenantCacheManager.FetchTenantByIdOrName(ctx, input.Tenant)
+	if len(input.Project) > 0 {
+		_, input.ProjectizedResourceInput, err = db.ValidateProjectizedResourceInput(ctx, input.ProjectizedResourceInput)
 		if err != nil {
-			if err == sql.ErrNoRows {
-				return input, httperrors.NewResourceNotFoundError("failed to found tenant %s", input.Tenant)
-			}
-			return input, httperrors.NewGeneralError(errors.Wrap(err, "FetchTenantByIdOrName"))
+			return input, errors.Wrap(err, "db.ValidateProjectizedResourceInput")
 		}
-		input.TenantId = tenantObj.GetId()
 	}
 
 	if !cloudprovider.IsSupported(input.Provider) {
@@ -474,7 +470,12 @@ func (self *SCloudaccount) CustomizeCreate(ctx context.Context, userCred mcclien
 	}
 	self.DomainId = ownerId.GetProjectDomainId()
 	// self.EnableAutoSync = false
+	// force private and share_mode=account_domain
 	self.ShareMode = api.CLOUD_ACCOUNT_SHARE_MODE_ACCOUNT_DOMAIN
+	self.IsPublic = false
+	self.PublicScope = string(rbacutils.ScopeNone)
+	// mark the public_scope has been set
+	data.(*jsonutils.JSONDict).Set("public_scope", jsonutils.NewString(self.PublicScope))
 	return self.SEnabledStatusInfrasResourceBase.CustomizeCreate(ctx, userCred, ownerId, query, data)
 }