diff --git a/pkg/keystone/models/default_admin.go b/pkg/keystone/models/default_admin.go
index f60ea72421..ee7baefab7 100644
--- a/pkg/keystone/models/default_admin.go
+++ b/pkg/keystone/models/default_admin.go
@@ -67,6 +67,7 @@ func getDefaultAdminCred() *mcclient.SSimpleToken {
 	token.ProjectDomain = prj.GetDomain().Name
 	rol, _ := RoleManager.FetchRole("", api.SystemAdminRole, api.DEFAULT_DOMAIN_ID, "")
 	token.Roles = rol.Name
+	token.SystemAccount = true
 	token.RoleIds = rol.Id
 	return &token
 }
diff --git a/pkg/keystone/tokens/token.go b/pkg/keystone/tokens/token.go
index 9155173bd1..a05b3b72c7 100644
--- a/pkg/keystone/tokens/token.go
+++ b/pkg/keystone/tokens/token.go
@@ -286,13 +286,14 @@ func (t *SAuthToken) GetSimpleUserCred(token string) (mcclient.TokenCredential,
 		return nil, errors.Wrap(err, "UserManager.FetchUserExtended")
 	}
 	ret := mcclient.SSimpleToken{
-		Token:    token,
-		UserId:   t.UserId,
-		User:     userExt.Name,
-		Domain:   userExt.DomainName,
-		DomainId: userExt.DomainId,
-		Expires:  t.ExpiresAt,
-		Context:  t.Context,
+		Token:         token,
+		UserId:        t.UserId,
+		User:          userExt.Name,
+		Domain:        userExt.DomainName,
+		DomainId:      userExt.DomainId,
+		Expires:       t.ExpiresAt,
+		Context:       t.Context,
+		SystemAccount: userExt.IsSystemAccount,
 	}
 	var roles []models.SRole
 	if len(t.ProjectId) > 0 {
diff --git a/pkg/mcclient/tokensimple.go b/pkg/mcclient/tokensimple.go
index 41a829a6cc..d7f19ff5a6 100644
--- a/pkg/mcclient/tokensimple.go
+++ b/pkg/mcclient/tokensimple.go
@@ -44,6 +44,8 @@ type SSimpleToken struct {
 	RoleIds string
 	Expires time.Time
 
+	SystemAccount bool
+
 	Context SAuthContext
 }
 
@@ -184,7 +186,7 @@ func (this *SSimpleToken) GetServiceCatalog() IServiceCatalog {
 }
 
 func (this *SSimpleToken) IsSystemAccount() bool {
-	return true
+	return this.SystemAccount
 }
 
 func (this *SSimpleToken) GetLoginSource() string {
@@ -218,6 +220,7 @@ func SimplifyToken(token TokenCredential) TokenCredential {
 			Source: token.GetLoginSource(),
 			Ip:     token.GetLoginIp(),
 		},
+		SystemAccount: token.IsSystemAccount(),
 	}
 }