diff --git a/pkg/cloudproxy/models/proxy_endpoints.go b/pkg/cloudproxy/models/proxy_endpoints.go
index df7204ec63..f5ee1fd68d 100644
--- a/pkg/cloudproxy/models/proxy_endpoints.go
+++ b/pkg/cloudproxy/models/proxy_endpoints.go
@@ -110,8 +110,8 @@ func (man *SProxyEndpointManager) PerformCreateFromServer(ctx context.Context, u
 		IntranetIpAddr: nic.IpAddr,
 	}
 	proxyendpoint.Name = name
-	proxyendpoint.DomainId = userCred.GetProjectDomainId()
-	proxyendpoint.ProjectId = userCred.GetProjectId()
+	proxyendpoint.DomainId = serverInfo.Server.DomainId
+	proxyendpoint.ProjectId = serverInfo.Server.ProjectId
 	if err := man.TableSpec().Insert(ctx, proxyendpoint); err != nil {
 		return nil, httperrors.NewServerError("database insertion error: %v", err)
 	}
diff --git a/pkg/compute/sshkeys/handler.go b/pkg/compute/sshkeys/handler.go
index 864551ca99..6b1f806571 100644
--- a/pkg/compute/sshkeys/handler.go
+++ b/pkg/compute/sshkeys/handler.go
@@ -41,7 +41,7 @@ func AddSshKeysHandler(prefix string, app *appsrv.Application) {
 func adminSshKeysHandler(ctx context.Context, w http.ResponseWriter, r *http.Request) {
 	publicOnly := false
 	userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
-	if !userCred.IsAllow(rbacutils.ScopeSystem, consts.GetServiceType(), "sshkeypairs", policy.PolicyActionGet) {
+	if !userCred.IsAllow(rbacutils.ScopeDomain, consts.GetServiceType(), "sshkeypairs", policy.PolicyActionGet) {
 		publicOnly = true
 	}
 	params := appctx.AppContextParams(ctx)
diff --git a/pkg/mcclient/models/base.go b/pkg/mcclient/models/base.go
index 0af92b0fc4..d4e2d6c492 100644
--- a/pkg/mcclient/models/base.go
+++ b/pkg/mcclient/models/base.go
@@ -77,6 +77,7 @@ type EnabledStatusStandaloneResource struct {
 type VirtualResource struct {
 	StatusStandaloneResource
 
+	DomainId         string
 	ProjectId        string
 	IsSystem         bool
 	PendingDeletedAt time.Time