diff --git a/pkg/cloudcommon/db/encrypted.go b/pkg/cloudcommon/db/encrypted.go
index 391e5bcdc3..baf3f79267 100644
--- a/pkg/cloudcommon/db/encrypted.go
+++ b/pkg/cloudcommon/db/encrypted.go
@@ -82,13 +82,6 @@ func (manager *SEncryptedResourceManager) ValidateCreateData(
 		if err != nil {
 			return input, errors.Wrap(err, "GetString key Id")
 		}
-		userId, err := keyObj.GetString("user_id")
-		if err != nil {
-			return input, errors.Wrap(err, "GetString user id")
-		}
-		if userId != ownerId.GetUserId() {
-			return input, errors.Wrap(httperrors.ErrForbidden, "non-owner not allow to access key")
-		}
 		input.EncryptKeyId = &keyId
 	}
 	return input, nil
diff --git a/pkg/mcclient/modules/identity/mod_credentials.go b/pkg/mcclient/modules/identity/mod_credentials.go
index ec1457cbb8..4dcae963fb 100644
--- a/pkg/mcclient/modules/identity/mod_credentials.go
+++ b/pkg/mcclient/modules/identity/mod_credentials.go
@@ -321,6 +321,19 @@ func DecodeEncryptKey(secret jsonutils.JSONObject) (SEncryptKeySecret, error) {
 	return curr, nil
 }
 
+func (manager *SCredentialManager) GetEncryptKeysRpc(s *mcclient.ClientSession, params jsonutils.JSONObject) (jsonutils.
+	JSONObject, error) {
+	keys, err := manager.GetEncryptKeys(s, "")
+	if err != nil {
+		return nil, errors.Wrap(err, "GetEncryptKeys")
+	}
+	ret := jsonutils.NewArray()
+	for _, key := range keys {
+		ret.Add(key.Marshal())
+	}
+	return ret, nil
+}
+
 func (manager *SCredentialManager) GetEncryptKeys(s *mcclient.ClientSession, uid string) ([]SEncryptKeySecret, error) {
 	secrets, err := manager.FetchEncryptionKeys(s, uid)
 	if err != nil {