diff --git a/pkg/keystone/tokens/auth.go b/pkg/keystone/tokens/auth.go
index e34c8d8213..89bd49abb5 100644
--- a/pkg/keystone/tokens/auth.go
+++ b/pkg/keystone/tokens/auth.go
@@ -17,7 +17,6 @@ package tokens
 import (
 	"context"
 	"database/sql"
-	"fmt"
 	"time"
 
 	"yunion.io/x/jsonutils"
@@ -152,8 +151,12 @@ func authUserByIdentity(ctx context.Context, ident mcclient.SAuthenticationIdent
 
 	idp := idpObj.(*models.SIdentityProvider)
 
+	if idp.Enabled.IsFalse() {
+		return nil, errors.Wrap(httperrors.ErrInvalidStatus, "idp disabled")
+	}
+
 	if idp.Status != api.IdentityDriverStatusConnected && idp.Status != api.IdentityDriverStatusDisconnected {
-		return nil, errors.Error(fmt.Sprintf("invalid idp status %s", idp.Status))
+		return nil, errors.Wrapf(httperrors.ErrInvalidStatus, "invalid idp status %s", idp.Status)
 	}
 
 	conf, err := models.GetConfigs(idp, true, nil, nil)