diff --git a/apps/acls/api/login_asset_check.py b/apps/acls/api/login_asset_check.py
index d689675b0..ee2fba4d5 100644
--- a/apps/acls/api/login_asset_check.py
+++ b/apps/acls/api/login_asset_check.py
@@ -61,7 +61,7 @@ class LoginAssetCheckAPI(CreateAPIView):
             'check_confirm_status': {'method': 'GET', 'url': confirm_status_url},
             'close_confirm': {'method': 'DELETE', 'url': confirm_status_url},
             'ticket_detail_url': ticket_detail_url,
-            'reviewers': [str(user) for user in ticket.assignees.all()],
+            'reviewers': [str(user) for user in ticket.current_node.first().ticket_assignees.all()],
         }
         return data
 
diff --git a/apps/applications/api/account.py b/apps/applications/api/account.py
index 3193467c3..8b28bcc37 100644
--- a/apps/applications/api/account.py
+++ b/apps/applications/api/account.py
@@ -12,7 +12,7 @@ from .. import serializers
 
 
 class AccountFilterSet(BaseFilterSet):
-    username = filters.CharFilter(field_name='username')
+    username = filters.CharFilter(method='do_nothing')
     type = filters.CharFilter(field_name='type', lookup_expr='exact')
     category = filters.CharFilter(field_name='category', lookup_expr='exact')
     app_display = filters.CharFilter(field_name='app_display', lookup_expr='exact')
diff --git a/apps/applications/api/application.py b/apps/applications/api/application.py
index 1090e0095..245379630 100644
--- a/apps/applications/api/application.py
+++ b/apps/applications/api/application.py
@@ -6,14 +6,15 @@ from rest_framework.decorators import action
 from rest_framework.response import Response
 
 from common.tree import TreeNodeSerializer
-from ..hands import IsOrgAdminOrAppUser, IsValidUser
+from common.mixins.views import SuggestionMixin
+from ..hands import IsOrgAdminOrAppUser
 from .. import serializers
 from ..models import Application
 
 __all__ = ['ApplicationViewSet']
 
 
-class ApplicationViewSet(OrgBulkModelViewSet):
+class ApplicationViewSet(SuggestionMixin, OrgBulkModelViewSet):
     model = Application
     filterset_fields = {
         'name': ['exact'],
@@ -24,7 +25,8 @@ class ApplicationViewSet(OrgBulkModelViewSet):
     permission_classes = (IsOrgAdminOrAppUser,)
     serializer_classes = {
         'default': serializers.AppSerializer,
-        'get_tree': TreeNodeSerializer
+        'get_tree': TreeNodeSerializer,
+        'suggestion': serializers.MiniAppSerializer
     }
 
     @action(methods=['GET'], detail=False, url_path='tree')
@@ -34,9 +36,3 @@ class ApplicationViewSet(OrgBulkModelViewSet):
         tree_nodes = Application.create_tree_nodes(queryset, show_count=show_count)
         serializer = self.get_serializer(tree_nodes, many=True)
         return Response(serializer.data)
-
-    @action(methods=['get'], detail=False, permission_classes=(IsValidUser,))
-    def suggestion(self, request):
-        queryset = self.filter_queryset(self.get_queryset())[:3]
-        serializer = self.get_serializer(queryset, many=True)
-        return Response(serializer.data)
diff --git a/apps/applications/serializers/application.py b/apps/applications/serializers/application.py
index 79cbdd3bc..0eba3e3e9 100644
--- a/apps/applications/serializers/application.py
+++ b/apps/applications/serializers/application.py
@@ -15,7 +15,7 @@ from .. import models
 from .. import const
 
 __all__ = [
-    'AppSerializer', 'AppSerializerMixin',
+    'AppSerializer', 'MiniAppSerializer', 'AppSerializerMixin',
     'AppAccountSerializer', 'AppAccountSecretSerializer'
 ]
 
@@ -78,6 +78,12 @@ class AppSerializer(AppSerializerMixin, BulkOrgResourceModelSerializer):
         return _attrs
 
 
+class MiniAppSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = models.Application
+        fields = AppSerializer.Meta.fields_mini
+
+
 class AppAccountSerializer(AuthSerializerMixin, BulkOrgResourceModelSerializer):
     category = serializers.ChoiceField(label=_('Category'), choices=const.AppCategory.choices, read_only=True)
     category_display = serializers.SerializerMethodField(label=_('Category display'))
diff --git a/apps/assets/api/asset.py b/apps/assets/api/asset.py
index 35023c39d..5fe0152d7 100644
--- a/apps/assets/api/asset.py
+++ b/apps/assets/api/asset.py
@@ -1,14 +1,13 @@
 # -*- coding: utf-8 -*-
 #
 from assets.api import FilterAssetByNodeMixin
-from rest_framework.decorators import action
 from rest_framework.viewsets import ModelViewSet
 from rest_framework.generics import RetrieveAPIView
-from rest_framework.response import Response
 from django.shortcuts import get_object_or_404
 
 from common.utils import get_logger, get_object_or_none
-from common.permissions import IsOrgAdmin, IsOrgAdminOrAppUser, IsSuperUser, IsValidUser
+from common.permissions import IsOrgAdmin, IsOrgAdminOrAppUser, IsSuperUser
+from common.mixins.views import SuggestionMixin
 from orgs.mixins.api import OrgBulkModelViewSet
 from orgs.mixins import generics
 from ..models import Asset, Node, Platform
@@ -27,7 +26,7 @@ __all__ = [
 ]
 
 
-class AssetViewSet(FilterAssetByNodeMixin, OrgBulkModelViewSet):
+class AssetViewSet(SuggestionMixin, FilterAssetByNodeMixin, OrgBulkModelViewSet):
     """
     API endpoint that allows Asset to be viewed or edited.
     """
@@ -64,12 +63,6 @@ class AssetViewSet(FilterAssetByNodeMixin, OrgBulkModelViewSet):
         assets = serializer.save()
         self.set_assets_node(assets)
 
-    @action(methods=['get'], detail=False, permission_classes=(IsValidUser,))
-    def suggestion(self, request):
-        queryset = self.filter_queryset(self.get_queryset())[:3]
-        serializer = self.get_serializer(queryset, many=True)
-        return Response(serializer.data)
-
 
 class AssetPlatformRetrieveApi(RetrieveAPIView):
     queryset = Platform.objects.all()
diff --git a/apps/assets/api/cmd_filter.py b/apps/assets/api/cmd_filter.py
index ca22c494f..948300d93 100644
--- a/apps/assets/api/cmd_filter.py
+++ b/apps/assets/api/cmd_filter.py
@@ -77,7 +77,7 @@ class CommandConfirmAPI(CreateAPIView):
             'check_confirm_status': {'method': 'GET', 'url': confirm_status_url},
             'close_confirm': {'method': 'DELETE', 'url': confirm_status_url},
             'ticket_detail_url': ticket_detail_url,
-            'reviewers': [str(user) for user in ticket.assignees.all()]
+            'reviewers': [str(user) for user in ticket.current_node.first().ticket_assignees.all()]
         }
 
     @lazyproperty
diff --git a/apps/assets/api/system_user.py b/apps/assets/api/system_user.py
index 03a506640..674ff2208 100644
--- a/apps/assets/api/system_user.py
+++ b/apps/assets/api/system_user.py
@@ -6,6 +6,7 @@ from common.utils import get_logger
 from common.permissions import IsOrgAdmin, IsOrgAdminOrAppUser, IsValidUser
 from orgs.mixins.api import OrgBulkModelViewSet
 from orgs.mixins import generics
+from common.mixins.views import SuggestionMixin
 from orgs.utils import tmp_to_root_org
 from ..models import SystemUser, Asset
 from .. import serializers
@@ -24,7 +25,7 @@ __all__ = [
 ]
 
 
-class SystemUserViewSet(OrgBulkModelViewSet):
+class SystemUserViewSet(SuggestionMixin, OrgBulkModelViewSet):
     """
     System user api set, for add,delete,update,list,retrieve resource
     """
@@ -39,6 +40,7 @@ class SystemUserViewSet(OrgBulkModelViewSet):
     serializer_class = serializers.SystemUserSerializer
     serializer_classes = {
         'default': serializers.SystemUserSerializer,
+        'suggestion': serializers.MiniSystemUserSerializer
     }
     permission_classes = (IsOrgAdminOrAppUser,)
 
diff --git a/apps/assets/models/domain.py b/apps/assets/models/domain.py
index 83b145249..7aafab504 100644
--- a/apps/assets/models/domain.py
+++ b/apps/assets/models/domain.py
@@ -120,6 +120,7 @@ class Gateway(BaseUser):
         except(paramiko.AuthenticationException,
                paramiko.BadAuthenticationType,
                paramiko.SSHException,
+               paramiko.ChannelException,
                paramiko.ssh_exception.NoValidConnectionsError,
                socket.gaierror) as e:
             err = str(e)
@@ -128,6 +129,8 @@ class Gateway(BaseUser):
                 err = err.format(port=self.port, ip=self.ip)
             elif err == 'Authentication failed.':
                 err = _('Authentication failed')
+            elif err == 'Connect failed':
+                err = _('Connect failed')
             self.is_connective = False
             return False, err
 
diff --git a/apps/assets/serializers/system_user.py b/apps/assets/serializers/system_user.py
index 69848ce20..8c4ebf98d 100644
--- a/apps/assets/serializers/system_user.py
+++ b/apps/assets/serializers/system_user.py
@@ -10,7 +10,7 @@ from .utils import validate_password_contains_left_double_curly_bracket
 from .base import AuthSerializerMixin
 
 __all__ = [
-    'SystemUserSerializer',
+    'SystemUserSerializer', 'MiniSystemUserSerializer',
     'SystemUserSimpleSerializer', 'SystemUserAssetRelationSerializer',
     'SystemUserNodeRelationSerializer', 'SystemUserTaskSerializer',
     'SystemUserUserRelationSerializer', 'SystemUserWithAuthInfoSerializer',
@@ -185,6 +185,12 @@ class SystemUserSerializer(AuthSerializerMixin, BulkOrgResourceModelSerializer):
         return queryset
 
 
+class MiniSystemUserSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = SystemUser
+        fields = SystemUserSerializer.Meta.fields_mini
+
+
 class SystemUserWithAuthInfoSerializer(SystemUserSerializer):
     class Meta(SystemUserSerializer.Meta):
         fields_mini = ['id', 'name', 'username']
@@ -208,6 +214,7 @@ class SystemUserSimpleSerializer(serializers.ModelSerializer):
     """
     系统用户最基本信息的数据结构
     """
+
     class Meta:
         model = SystemUser
         fields = ('id', 'name', 'username')
diff --git a/apps/audits/signals_handler.py b/apps/audits/signals_handler.py
index 70f8a863c..c793481e8 100644
--- a/apps/audits/signals_handler.py
+++ b/apps/audits/signals_handler.py
@@ -1,6 +1,8 @@
 # -*- coding: utf-8 -*-
 #
-from django.db.models.signals import post_save, post_delete, m2m_changed
+from django.db.models.signals import (
+    post_save, post_delete, m2m_changed, pre_delete
+)
 from django.dispatch import receiver
 from django.conf import settings
 from django.db import transaction
@@ -35,7 +37,7 @@ MODELS_NEED_RECORD = (
     # users
     'User', 'UserGroup',
     # acls
-    'LoginACL', 'LoginAssetACL',
+    'LoginACL', 'LoginAssetACL', 'LoginConfirmSetting',
     # assets
     'Asset', 'Node', 'AdminUser', 'SystemUser', 'Domain', 'Gateway', 'CommandFilterRule',
     'CommandFilter', 'Platform', 'AuthBook',
@@ -98,68 +100,68 @@ def create_operate_log(action, sender, resource):
 M2M_NEED_RECORD = {
     'OrganizationMember': (
         _('User and Organization'),
-        _('{User} *JOINED* {Organization}'),
-        _('{User} *LEFT* {Organization}')
+        _('{User} JOINED {Organization}'),
+        _('{User} LEFT {Organization}')
     ),
     User.groups.through._meta.object_name: (
         _('User and Group'),
-        _('{User} *JOINED* {UserGroup}'),
-        _('{User} *LEFT* {UserGroup}')
+        _('{User} JOINED {UserGroup}'),
+        _('{User} LEFT {UserGroup}')
     ),
     SystemUser.assets.through._meta.object_name: (
         _('Asset and SystemUser'),
-        _('{Asset} *ADD* {SystemUser}'),
-        _('{Asset} *REMOVE* {SystemUser}')
+        _('{Asset} ADD {SystemUser}'),
+        _('{Asset} REMOVE {SystemUser}')
     ),
     Asset.nodes.through._meta.object_name: (
         _('Node and Asset'),
-        _('{Node} *ADD* {Asset}'),
-        _('{Node} *REMOVE* {Asset}')
+        _('{Node} ADD {Asset}'),
+        _('{Node} REMOVE {Asset}')
     ),
     AssetPermission.users.through._meta.object_name: (
         _('User asset permissions'),
-        _('{AssetPermission} *ADD* {User}'),
-        _('{AssetPermission} *REMOVE* {User}'),
+        _('{AssetPermission} ADD {User}'),
+        _('{AssetPermission} REMOVE {User}'),
     ),
     AssetPermission.user_groups.through._meta.object_name: (
         _('User group asset permissions'),
-        _('{AssetPermission} *ADD* {UserGroup}'),
-        _('{AssetPermission} *REMOVE* {UserGroup}'),
+        _('{AssetPermission} ADD {UserGroup}'),
+        _('{AssetPermission} REMOVE {UserGroup}'),
     ),
     AssetPermission.assets.through._meta.object_name: (
         _('Asset permission'),
-        _('{AssetPermission} *ADD* {Asset}'),
-        _('{AssetPermission} *REMOVE* {Asset}'),
+        _('{AssetPermission} ADD {Asset}'),
+        _('{AssetPermission} REMOVE {Asset}'),
     ),
     AssetPermission.nodes.through._meta.object_name: (
         _('Node permission'),
-        _('{AssetPermission} *ADD* {Node}'),
-        _('{AssetPermission} *REMOVE* {Node}'),
+        _('{AssetPermission} ADD {Node}'),
+        _('{AssetPermission} REMOVE {Node}'),
     ),
     AssetPermission.system_users.through._meta.object_name: (
         _('Asset permission and SystemUser'),
-        _('{AssetPermission} *ADD* {SystemUser}'),
-        _('{AssetPermission} *REMOVE* {SystemUser}'),
+        _('{AssetPermission} ADD {SystemUser}'),
+        _('{AssetPermission} REMOVE {SystemUser}'),
     ),
     ApplicationPermission.users.through._meta.object_name: (
         _('User application permissions'),
-        _('{ApplicationPermission} *ADD* {User}'),
-        _('{ApplicationPermission} *REMOVE* {User}'),
+        _('{ApplicationPermission} ADD {User}'),
+        _('{ApplicationPermission} REMOVE {User}'),
     ),
     ApplicationPermission.user_groups.through._meta.object_name: (
         _('User group application permissions'),
-        _('{ApplicationPermission} *ADD* {UserGroup}'),
-        _('{ApplicationPermission} *REMOVE* {UserGroup}'),
+        _('{ApplicationPermission} ADD {UserGroup}'),
+        _('{ApplicationPermission} REMOVE {UserGroup}'),
     ),
     ApplicationPermission.applications.through._meta.object_name: (
         _('Application permission'),
-        _('{ApplicationPermission} *ADD* {Application}'),
-        _('{ApplicationPermission} *REMOVE* {Application}'),
+        _('{ApplicationPermission} ADD {Application}'),
+        _('{ApplicationPermission} REMOVE {Application}'),
     ),
     ApplicationPermission.system_users.through._meta.object_name: (
         _('Application permission and SystemUser'),
-        _('{ApplicationPermission} *ADD* {SystemUser}'),
-        _('{ApplicationPermission} *REMOVE* {SystemUser}'),
+        _('{ApplicationPermission} ADD {SystemUser}'),
+        _('{ApplicationPermission} REMOVE {SystemUser}'),
     ),
 }
 
@@ -226,7 +228,7 @@ def on_object_created_or_update(sender, instance=None, created=False, update_fie
     create_operate_log(action, sender, instance)
 
 
-@receiver(post_delete)
+@receiver(pre_delete)
 def on_object_delete(sender, instance=None, **kwargs):
     create_operate_log(models.OperateLog.ACTION_DELETE, sender, instance)
 
diff --git a/apps/authentication/errors.py b/apps/authentication/errors.py
index c8005ba95..f2346ab6d 100644
--- a/apps/authentication/errors.py
+++ b/apps/authentication/errors.py
@@ -71,7 +71,7 @@ sms_failed_msg = _(
     "(The account will be temporarily locked for {block_time} minutes)"
 )
 mfa_type_failed_msg = _(
-    "The MFA type({mfa_type}) is not supported"
+    "The MFA type({mfa_type}) is not supported, "
     "You can also try {times_try} times "
     "(The account will be temporarily locked for {block_time} minutes)"
 )
diff --git a/apps/authentication/mixins.py b/apps/authentication/mixins.py
index 3a2f9c09b..79f747ee0 100644
--- a/apps/authentication/mixins.py
+++ b/apps/authentication/mixins.py
@@ -346,6 +346,10 @@ class AuthMixin(PasswordEncryptionViewMixin):
     def check_user_mfa_if_need(self, user):
         if self.request.session.get('auth_mfa'):
             return
+
+        if settings.OTP_IN_RADIUS:
+            return
+
         if not user.mfa_enabled:
             return
         unset, url = user.mfa_enabled_but_not_set()
@@ -411,11 +415,11 @@ class AuthMixin(PasswordEncryptionViewMixin):
             return
         elif ticket.state_reject:
             raise errors.LoginConfirmOtherError(
-                ticket.id, ticket.get_action_display()
+                ticket.id, ticket.get_state_display()
             )
         elif ticket.state_close:
             raise errors.LoginConfirmOtherError(
-                ticket.id, ticket.get_action_display()
+                ticket.id, ticket.get_state_display()
             )
         else:
             raise errors.LoginConfirmOtherError(
diff --git a/apps/authentication/models.py b/apps/authentication/models.py
index c74d06953..62bd74392 100644
--- a/apps/authentication/models.py
+++ b/apps/authentication/models.py
@@ -45,6 +45,9 @@ class LoginConfirmSetting(CommonModelMixin):
     reviewers = models.ManyToManyField('users.User', verbose_name=_("Reviewers"), related_name="review_login_confirm_settings", blank=True)
     is_active = models.BooleanField(default=True, verbose_name=_("Is active"))
 
+    class Meta:
+        verbose_name = _('Login Confirm')
+
     @classmethod
     def get_user_confirm_setting(cls, user):
         return get_object_or_none(cls, user=user)
@@ -83,7 +86,8 @@ class LoginConfirmSetting(CommonModelMixin):
         return ticket
 
     def __str__(self):
-        return '{} confirm'.format(self.user.username)
+        reviewers = [u.username for u in self.reviewers.all()]
+        return _('{} need confirm by {}').format(self.user.username, reviewers)
 
 
 class SSOToken(models.JMSBaseModel):
diff --git a/apps/authentication/signals_handlers.py b/apps/authentication/signals_handlers.py
index c6c1db680..87b177ff5 100644
--- a/apps/authentication/signals_handlers.py
+++ b/apps/authentication/signals_handlers.py
@@ -14,7 +14,8 @@ from .signals import post_auth_success, post_auth_failed
 @receiver(user_logged_in)
 def on_user_auth_login_success(sender, user, request, **kwargs):
     # 开启了 MFA，且没有校验过
-    if user.mfa_enabled and not request.session.get('auth_mfa'):
+
+    if user.mfa_enabled and not settings.OTP_IN_RADIUS and not request.session.get('auth_mfa'):
         request.session['auth_mfa_required'] = 1
 
     if settings.USER_LOGIN_SINGLE_MACHINE_ENABLED:
diff --git a/apps/authentication/sms_verify_code.py b/apps/authentication/sms_verify_code.py
index 33d17b207..0c3e986ce 100644
--- a/apps/authentication/sms_verify_code.py
+++ b/apps/authentication/sms_verify_code.py
@@ -52,10 +52,13 @@ class VerifyCodeUtil:
         ttl = self.ttl()
         if ttl > 0:
             raise CodeSendTooFrequently(ttl)
-
-        self.generate()
-        self.save()
-        self.send()
+        try:
+            self.generate()
+            self.save()
+            self.send()
+        except JMSException:
+            self.clear()
+            raise
 
     def generate(self):
         code = ''.join(random.sample('0123456789', 4))
diff --git a/apps/authentication/templates/authentication/login_otp.html b/apps/authentication/templates/authentication/login_otp.html
index 858c2737d..ff4d4e28b 100644
--- a/apps/authentication/templates/authentication/login_otp.html
+++ b/apps/authentication/templates/authentication/login_otp.html
@@ -19,19 +19,25 @@
             {% endfor %}
             </select>
         </div>
-        <div class="form-group">
-            <input type="text" class="form-control" name="code" placeholder="" required="" autofocus="autofocus">
-            <span class="help-block">
-                {% trans 'Please enter the verification code' %}
-            </span>
-        </div>
-        <button id='send-sms-verify-code' class="btn btn-primary full-width m-b" onclick="sendSMSVerifyCode()" style="display: none">{% trans 'Send verification code' %}</button>
-        <button type="submit" class="btn btn-primary block full-width m-b">{% trans 'Next' %}</button>
+        <div class="form-group" style="display: flex">
 
+            <input id="mfa-code" required type="text" class="form-control" name="code" placeholder="{% trans 'Please enter the verification code' %}" autofocus="autofocus">
+            <button id='send-sms-verify-code' type="button" class="btn btn-info full-width m-b" onclick="sendSMSVerifyCode()" style="width: 150px!important;">{% trans 'Send verification code' %}</button>
+
+        </div>
+
+        <button id='submit_button' type="submit" class="btn btn-primary block full-width m-b">{% trans 'Next' %}</button>
         <div>
             <small>{% trans "Can't provide security? Please contact the administrator!" %}</small>
         </div>
     </form>
+    <style type="text/css">
+    .disabledBtn {
+        background: #e6e4e4!important;
+        border-color: #d8d5d5!important;
+        color: #949191!important;
+    }
+    </style>
     <script>
 
     var methodSelect = document.getElementById('verify-method-select');
@@ -44,19 +50,35 @@
 
         if (type == "sms") {
             currentBtn.style.display = "block";
+            currentBtn.disabled = false;
         }
         else {
             currentBtn.style.display = "none";
+            currentBtn.disabled = true;
         }
     }
-
     function sendSMSVerifyCode(){
+        var currentBtn = document.getElementById('send-sms-verify-code');
+        var time = 60
         var url = "{% url 'api-auth:sms-verify-code-send' %}";
         requestApi({
             url: url,
             method: "POST",
             success: function (data) {
-                alert('验证码已发送');
+                currentBtn.innerHTML =  `{% trans 'Wait: ' %} ${time}`;
+                currentBtn.disabled = true
+                currentBtn.classList.add("disabledBtn" )
+                var TimeInterval = setInterval(()=>{
+                    --time
+                    currentBtn.innerHTML = `{% trans 'Wait: ' %} ${time}`;
+                    if(time === 0) {
+                        currentBtn.innerHTML = "{% trans 'Send verification code' %}"
+                        currentBtn.disabled = false
+                        currentBtn.classList.remove("disabledBtn")
+                        clearInterval(TimeInterval)
+                    }
+                },1000)
+                alert("{% trans 'The verification code has been sent' %}");
             },
             error: function (text, data) {
                 alert(data.detail)
diff --git a/apps/authentication/views/login.py b/apps/authentication/views/login.py
index 4fc39b4ac..084004a3a 100644
--- a/apps/authentication/views/login.py
+++ b/apps/authentication/views/login.py
@@ -66,10 +66,12 @@ class UserLoginView(mixins.AuthMixin, FormView):
             return None
 
         login_redirect = settings.LOGIN_REDIRECT_TO_BACKEND.lower()
-        if login_redirect == ['CAS', 'cas'] and cas_auth_url:
+        if login_redirect in ['cas'] and cas_auth_url:
             auth_url = cas_auth_url
-        else:
+        elif login_redirect in ['openid', 'oidc'] and openid_auth_url:
             auth_url = openid_auth_url
+        else:
+            auth_url = openid_auth_url or cas_auth_url
 
         if settings.LOGIN_REDIRECT_TO_BACKEND or not settings.LOGIN_REDIRECT_MSG_ENABLED:
             redirect_url = auth_url
@@ -212,8 +214,10 @@ class UserLoginWaitConfirmView(TemplateView):
         if ticket:
             timestamp_created = datetime.datetime.timestamp(ticket.date_created)
             ticket_detail_url = TICKET_DETAIL_URL.format(id=ticket_id)
+            assignees = ticket.current_node.first().ticket_assignees.all()
+            assignees_display = ', '.join([str(i.assignee) for i in assignees])
             msg = _("""Wait for <b>{}</b> confirm, You also can copy link to her/him <br/>
-                  Don't close this page""").format(ticket.assignees_display)
+                  Don't close this page""").format(assignees_display)
         else:
             timestamp_created = 0
             ticket_detail_url = ''
diff --git a/apps/authentication/views/mfa.py b/apps/authentication/views/mfa.py
index 35fa58f94..eb1c05a84 100644
--- a/apps/authentication/views/mfa.py
+++ b/apps/authentication/views/mfa.py
@@ -32,7 +32,7 @@ class UserLoginOtpView(mixins.AuthMixin, FormView):
         except Exception as e:
             logger.error(e)
             import traceback
-            traceback.print_exception()
+            traceback.print_exception(e)
             return redirect_to_guard_view()
 
     def get_context_data(self, **kwargs):
diff --git a/apps/common/message/backends/sms/__init__.py b/apps/common/message/backends/sms/__init__.py
index be32c6e94..3eaf6fecf 100644
--- a/apps/common/message/backends/sms/__init__.py
+++ b/apps/common/message/backends/sms/__init__.py
@@ -11,37 +11,9 @@ from common.exceptions import JMSException
 logger = get_logger(__file__)
 
 
-class SMS_MESSAGE(TextChoices):
-    """
-    定义短信的各种消息类型，会存到类似 `ALIBABA_SMS_SIGN_AND_TEMPLATES` settings 里
-
-    {
-        'verification_code': {'sign_name': 'Jumpserver', 'template_code': 'SMS_222870834'}，
-        ...
-    }
-    """
-
-    """
-    验证码签名和模板。模板例子:
-    `您的验证码：${code}，您正进行身份验证，打死不告诉别人！`
-    其中必须包含 `code` 变量
-    """
-    VERIFICATION_CODE = 'verification_code'
-
-    def get_sign_and_tmpl(self, config: dict):
-        try:
-            data = config[self]
-            return data['sign_name'], data['template_code']
-        except KeyError as e:
-            raise JMSException(
-                code=f'{settings.SMS_BACKEND}_sign_and_tmpl_bad',
-                detail=_('Invalid SMS sign and template: {}').format(e)
-            )
-
-
 class BACKENDS(TextChoices):
-    ALIBABA = 'alibaba', _('Alibaba')
-    TENCENT = 'tencent', _('Tencent')
+    ALIBABA = 'alibaba', _('Alibaba cloud')
+    TENCENT = 'tencent', _('Tencent cloud')
 
 
 class BaseSMSClient:
@@ -49,11 +21,7 @@ class BaseSMSClient:
     短信终端的基类
     """
 
-    SIGN_AND_TMPL_SETTING_FIELD: str
-
-    @property
-    def sign_and_tmpl(self):
-        return getattr(settings, self.SIGN_AND_TMPL_SETTING_FIELD, {})
+    SIGN_AND_TMPL_SETTING_FIELD_PREFIX: str
 
     @classmethod
     def new_from_settings(cls):
@@ -67,6 +35,12 @@ class SMS:
     client: BaseSMSClient
 
     def __init__(self, backend=None):
+        backend = backend or settings.SMS_BACKEND
+        if backend not in BACKENDS:
+            raise JMSException(
+                code='sms_provider_not_support',
+                detail=_('SMS provider not support: {}').format(backend)
+            )
         m = importlib.import_module(f'.{backend or settings.SMS_BACKEND}', __package__)
         self.client = m.client.new_from_settings()
 
@@ -80,5 +54,12 @@ class SMS:
         )
 
     def send_verify_code(self, phone_number, code):
-        sign_name, template_code = SMS_MESSAGE.VERIFICATION_CODE.get_sign_and_tmpl(self.client.sign_and_tmpl)
+        sign_name = getattr(settings, f'{self.client.SIGN_AND_TMPL_SETTING_FIELD_PREFIX}_VERIFY_SIGN_NAME')
+        template_code = getattr(settings, f'{self.client.SIGN_AND_TMPL_SETTING_FIELD_PREFIX}_VERIFY_TEMPLATE_CODE')
+
+        if not (sign_name and template_code):
+            raise JMSException(
+                code='verify_code_sign_tmpl_invalid',
+                detail=_('SMS verification code signature or template invalid')
+            )
         return self.send_sms([phone_number], sign_name, template_code, OrderedDict(code=code))
diff --git a/apps/common/message/backends/sms/alibaba.py b/apps/common/message/backends/sms/alibaba.py
index b664f4401..2c5532c4f 100644
--- a/apps/common/message/backends/sms/alibaba.py
+++ b/apps/common/message/backends/sms/alibaba.py
@@ -15,7 +15,7 @@ logger = get_logger(__file__)
 
 
 class AlibabaSMS(BaseSMSClient):
-    SIGN_AND_TMPL_SETTING_FIELD = 'ALIBABA_SMS_SIGN_AND_TEMPLATES'
+    SIGN_AND_TMPL_SETTING_FIELD_PREFIX = 'ALIBABA'
 
     @classmethod
     def new_from_settings(cls):
diff --git a/apps/common/message/backends/sms/tencent.py b/apps/common/message/backends/sms/tencent.py
index 6f796bb15..427e8b7dd 100644
--- a/apps/common/message/backends/sms/tencent.py
+++ b/apps/common/message/backends/sms/tencent.py
@@ -20,7 +20,7 @@ class TencentSMS(BaseSMSClient):
     """
     https://cloud.tencent.com/document/product/382/43196#.E5.8F.91.E9.80.81.E7.9F.AD.E4.BF.A1
     """
-    SIGN_AND_TMPL_SETTING_FIELD = 'TENCENT_SMS_SIGN_AND_TEMPLATES'
+    SIGN_AND_TMPL_SETTING_FIELD_PREFIX = 'TENCENT'
 
     @classmethod
     def new_from_settings(cls):
diff --git a/apps/common/mixins/views.py b/apps/common/mixins/views.py
index 1590f48ba..a4bc32b76 100644
--- a/apps/common/mixins/views.py
+++ b/apps/common/mixins/views.py
@@ -3,12 +3,14 @@
 # coding: utf-8
 from django.contrib.auth.mixins import UserPassesTestMixin
 from django.utils import timezone
+from rest_framework.decorators import action
+from rest_framework import permissions
+from rest_framework.response import Response
 
+from common.permissions import IsValidUser
 
 __all__ = ["DatetimeSearchMixin", "PermissionsMixin"]
 
-from rest_framework import permissions
-
 
 class DatetimeSearchMixin:
     date_format = '%Y-%m-%d'
@@ -52,3 +54,19 @@ class PermissionsMixin(UserPassesTestMixin):
             if not permission_class().has_permission(self.request, self):
                 return False
         return True
+
+
+class SuggestionMixin:
+    suggestion_mini_count = 10
+
+    @action(methods=['get'], detail=False, permission_classes=(IsValidUser,))
+    def suggestions(self, request, *args, **kwargs):
+        queryset = self.filter_queryset(self.get_queryset())
+        queryset = queryset[:self.suggestion_mini_count]
+        page = self.paginate_queryset(queryset)
+        if page is not None:
+            serializer = self.get_serializer(page, many=True)
+            return self.get_paginated_response(serializer.data)
+
+        serializer = self.get_serializer(queryset, many=True)
+        return Response(serializer.data)
diff --git a/apps/common/permissions.py b/apps/common/permissions.py
index b0f217c1c..750a41475 100644
--- a/apps/common/permissions.py
+++ b/apps/common/permissions.py
@@ -33,6 +33,8 @@ class IsSuperUser(IsValidUser):
 
 class IsSuperUserOrAppUser(IsSuperUser):
     def has_permission(self, request, view):
+        if request.user.is_anonymous:
+            return False
         return super(IsSuperUserOrAppUser, self).has_permission(request, view) \
             or request.user.is_app
 
@@ -67,6 +69,8 @@ class IsOrgAdminOrAppUser(IsValidUser):
     def has_permission(self, request, view):
         if not current_org:
             return False
+        if request.user.is_anonymous:
+            return False
         return super(IsOrgAdminOrAppUser, self).has_permission(request, view) \
             and (current_org.can_admin_by(request.user) or request.user.is_app)
 
diff --git a/apps/jumpserver/api.py b/apps/jumpserver/api.py
index 6be2e4407..e67bff1cd 100644
--- a/apps/jumpserver/api.py
+++ b/apps/jumpserver/api.py
@@ -17,9 +17,10 @@ from terminal.models import Session
 from terminal.utils import ComponentsPrometheusMetricsUtil
 from orgs.utils import current_org
 from common.permissions import IsOrgAdmin, IsOrgAuditor
-from common.utils import lazyproperty
+from common.utils import lazyproperty, get_request_ip
 from orgs.caches import OrgResourceStatisticsCache
 
+
 __all__ = ['IndexApi']
 
 
@@ -297,19 +298,33 @@ class IndexApi(DatesLoginMetricMixin, APIView):
 
 
 class HealthApiMixin(APIView):
-    def is_token_right(self):
-        token = self.request.query_params.get('token')
-        ok_token = settings.HEALTH_CHECK_TOKEN
-        if ok_token and token != ok_token:
-            return False
-        return True
+    pass
 
-    def check_permissions(self, request):
-        if not self.is_token_right():
-            msg = 'Health check token error, ' \
-                  'Please set query param in url and same with setting HEALTH_CHECK_TOKEN. ' \
-                  'eg: $PATH/?token=$HEALTH_CHECK_TOKEN'
-            self.permission_denied(request, message={'error': msg}, code=403)
+    # 先去掉 Health Api 的权限校验，方便各组件直接调用
+
+    # def is_token_right(self):
+    #     token = self.request.query_params.get('token')
+    #     ok_token = settings.HEALTH_CHECK_TOKEN
+    #     if ok_token and token != ok_token:
+    #         return False
+    #     return True
+
+    # def is_localhost(self):
+    #     ip = get_request_ip(self.request)
+    #     return ip in ['localhost', '127.0.0.1']
+
+    # def check_permissions(self, request):
+    #      if self.is_token_right():
+    #          return
+    #      if self.is_localhost():
+    #          return
+    #      msg = '''
+    #      Health check token error,
+    #      Please set query param in url and
+    #      same with setting HEALTH_CHECK_TOKEN.
+    #      eg: $PATH/?token=$HEALTH_CHECK_TOKEN
+    #      '''
+    #      self.permission_denied(request, message={'error': msg}, code=403)
 
 
 class HealthCheckView(HealthApiMixin):
diff --git a/apps/jumpserver/conf.py b/apps/jumpserver/conf.py
index 74fd3b708..a2e96966f 100644
--- a/apps/jumpserver/conf.py
+++ b/apps/jumpserver/conf.py
@@ -249,12 +249,14 @@ class Config(dict):
 
         'ALIBABA_ACCESS_KEY_ID': '',
         'ALIBABA_ACCESS_KEY_SECRET': '',
-        'ALIBABA_SMS_SIGN_AND_TEMPLATES': {},
+        'ALIBABA_VERIFY_SIGN_NAME': '',
+        'ALIBABA_VERIFY_TEMPLATE_CODE': '',
 
         'TENCENT_SECRET_ID': '',
         'TENCENT_SECRET_KEY': '',
         'TENCENT_SDKAPPID': '',
-        'TENCENT_SMS_SIGN_AND_TEMPLATES': {},
+        'TENCENT_VERIFY_SIGN_NAME': '',
+        'TENCENT_VERIFY_TEMPLATE_CODE': '',
 
         'OTP_VALID_WINDOW': 2,
         'OTP_ISSUER_NAME': 'JumpServer',
diff --git a/apps/jumpserver/settings/auth.py b/apps/jumpserver/settings/auth.py
index ac9fdb631..06eb5e7b6 100644
--- a/apps/jumpserver/settings/auth.py
+++ b/apps/jumpserver/settings/auth.py
@@ -122,21 +122,7 @@ AUTH_FEISHU = CONFIG.AUTH_FEISHU
 FEISHU_APP_ID = CONFIG.FEISHU_APP_ID
 FEISHU_APP_SECRET = CONFIG.FEISHU_APP_SECRET
 
-# SMS auth
-SMS_ENABLED = CONFIG.SMS_ENABLED
-SMS_BACKEND = CONFIG.SMS_BACKEND
-SMS_TEST_PHONE = CONFIG.SMS_TEST_PHONE
 
-# Alibaba
-ALIBABA_ACCESS_KEY_ID = CONFIG.ALIBABA_ACCESS_KEY_ID
-ALIBABA_ACCESS_KEY_SECRET = CONFIG.ALIBABA_ACCESS_KEY_SECRET
-ALIBABA_SMS_SIGN_AND_TEMPLATES = CONFIG.ALIBABA_SMS_SIGN_AND_TEMPLATES
-
-# TENCENT
-TENCENT_SECRET_ID = CONFIG.TENCENT_SECRET_ID
-TENCENT_SECRET_KEY = CONFIG.TENCENT_SECRET_KEY
-TENCENT_SDKAPPID = CONFIG.TENCENT_SDKAPPID
-TENCENT_SMS_SIGN_AND_TEMPLATES = CONFIG.TENCENT_SMS_SIGN_AND_TEMPLATES
 
 # Other setting
 TOKEN_EXPIRATION = CONFIG.TOKEN_EXPIRATION
@@ -161,6 +147,7 @@ AUTH_BACKEND_AUTH_TOKEN = 'authentication.backends.api.AuthorizationTokenAuthent
 AUTHENTICATION_BACKENDS = [
     AUTH_BACKEND_MODEL, AUTH_BACKEND_PUBKEY, AUTH_BACKEND_WECOM,
     AUTH_BACKEND_DINGTALK, AUTH_BACKEND_FEISHU, AUTH_BACKEND_AUTH_TOKEN,
+    AUTH_BACKEND_SSO,
 ]
 
 if AUTH_CAS:
@@ -170,8 +157,6 @@ if AUTH_OPENID:
     AUTHENTICATION_BACKENDS.insert(0, AUTH_BACKEND_OIDC_CODE)
 if AUTH_RADIUS:
     AUTHENTICATION_BACKENDS.insert(0, AUTH_BACKEND_RADIUS)
-if AUTH_SSO:
-    AUTHENTICATION_BACKENDS.append(AUTH_BACKEND_SSO)
 
 
 ONLY_ALLOW_EXIST_USER_AUTH = CONFIG.ONLY_ALLOW_EXIST_USER_AUTH
diff --git a/apps/jumpserver/settings/custom.py b/apps/jumpserver/settings/custom.py
index 0ef447621..91973d1b2 100644
--- a/apps/jumpserver/settings/custom.py
+++ b/apps/jumpserver/settings/custom.py
@@ -132,3 +132,20 @@ LOGIN_REDIRECT_MSG_ENABLED = CONFIG.LOGIN_REDIRECT_MSG_ENABLED
 CLOUD_SYNC_TASK_EXECUTION_KEEP_DAYS = CONFIG.CLOUD_SYNC_TASK_EXECUTION_KEEP_DAYS
 
 XRDP_ENABLED = CONFIG.XRDP_ENABLED
+
+
+# SMS enabled
+SMS_ENABLED = CONFIG.SMS_ENABLED
+SMS_BACKEND = CONFIG.SMS_BACKEND
+SMS_TEST_PHONE = CONFIG.SMS_TEST_PHONE
+
+# Alibaba
+ALIBABA_ACCESS_KEY_ID = CONFIG.ALIBABA_ACCESS_KEY_ID
+ALIBABA_ACCESS_KEY_SECRET = CONFIG.ALIBABA_ACCESS_KEY_SECRET
+ALIBABA_SMS_SIGN_AND_TEMPLATES = CONFIG.ALIBABA_SMS_SIGN_AND_TEMPLATES
+
+# TENCENT
+TENCENT_SECRET_ID = CONFIG.TENCENT_SECRET_ID
+TENCENT_SECRET_KEY = CONFIG.TENCENT_SECRET_KEY
+TENCENT_SDKAPPID = CONFIG.TENCENT_SDKAPPID
+TENCENT_SMS_SIGN_AND_TEMPLATES = CONFIG.TENCENT_SMS_SIGN_AND_TEMPLATES
diff --git a/apps/locale/zh/LC_MESSAGES/django.mo b/apps/locale/zh/LC_MESSAGES/django.mo
index c873509ac..fbb686b24 100644
Binary files a/apps/locale/zh/LC_MESSAGES/django.mo and b/apps/locale/zh/LC_MESSAGES/django.mo differ
diff --git a/apps/locale/zh/LC_MESSAGES/django.po b/apps/locale/zh/LC_MESSAGES/django.po
index e36335bda..46be54fe7 100644
--- a/apps/locale/zh/LC_MESSAGES/django.po
+++ b/apps/locale/zh/LC_MESSAGES/django.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: JumpServer 0.3.3\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2021-09-09 20:13+0800\n"
+"POT-Creation-Date: 2021-09-13 20:32+0800\n"
 "PO-Revision-Date: 2021-05-20 10:54+0800\n"
 "Last-Translator: ibuler <ibuler@qq.com>\n"
 "Language-Team: JumpServer team<ibuler@qq.com>\n"
@@ -60,8 +60,8 @@ msgstr "激活中"
 #: orgs/models.py:27 perms/models/base.py:53 settings/models.py:34
 #: terminal/models/storage.py:26 terminal/models/terminal.py:114
 #: tickets/models/ticket.py:71 users/models/group.py:16
-#: users/models/user.py:637 xpack/plugins/change_auth_plan/models.py:77
-#: xpack/plugins/cloud/models.py:35 xpack/plugins/cloud/models.py:108
+#: users/models/user.py:637 xpack/plugins/change_auth_plan/models/base.py:41
+#: xpack/plugins/cloud/models.py:35 xpack/plugins/cloud/models.py:113
 #: xpack/plugins/gathered_user/models.py:26
 msgid "Comment"
 msgstr "备注"
@@ -93,7 +93,7 @@ msgstr "动作"
 #: acls/serializers/login_acl.py:33 assets/models/label.py:15
 #: audits/models.py:36 audits/models.py:56 audits/models.py:74
 #: audits/serializers.py:93 authentication/models.py:44
-#: authentication/models.py:96 orgs/models.py:19 orgs/models.py:433
+#: authentication/models.py:100 orgs/models.py:19 orgs/models.py:433
 #: perms/models/base.py:45 templates/index.html:78
 #: terminal/backends/command/models.py:18
 #: terminal/backends/command/serializers.py:12 terminal/models/session.py:38
@@ -107,7 +107,7 @@ msgstr "动作"
 msgid "User"
 msgstr "用户"
 
-#: acls/models/login_asset_acl.py:17 authentication/models.py:72
+#: acls/models/login_asset_acl.py:17 authentication/models.py:75
 #: tickets/const.py:9
 msgid "Login confirm"
 msgstr "登录复核"
@@ -119,14 +119,14 @@ msgstr "系统用户"
 #: acls/models/login_asset_acl.py:22
 #: applications/serializers/attrs/application_category/remote_app.py:37
 #: assets/models/asset.py:357 assets/models/authbook.py:15
-#: assets/models/gathered_user.py:14 assets/serializers/system_user.py:201
+#: assets/models/gathered_user.py:14 assets/serializers/system_user.py:207
 #: audits/models.py:38 perms/models/asset_permission.py:99
 #: templates/index.html:82 terminal/backends/command/models.py:19
 #: terminal/backends/command/serializers.py:13 terminal/models/session.py:40
 #: users/templates/users/user_asset_permission.html:40
 #: users/templates/users/user_asset_permission.html:70
-#: xpack/plugins/change_auth_plan/models.py:282
-#: xpack/plugins/cloud/models.py:212
+#: xpack/plugins/change_auth_plan/models/asset.py:195
+#: xpack/plugins/cloud/models.py:217
 msgid "Asset"
 msgstr "资产"
 
@@ -139,7 +139,7 @@ msgstr "审批人"
 msgid "Login asset confirm"
 msgstr "登录资产复核"
 
-#: acls/serializers/login_acl.py:18 xpack/plugins/cloud/serializers.py:165
+#: acls/serializers/login_acl.py:18 xpack/plugins/cloud/serializers/task.py:23
 msgid "IP address invalid: `{}`"
 msgstr "IP 地址无效: `{}`"
 
@@ -179,9 +179,9 @@ msgstr "格式为逗号分隔的字符串, * 表示匹配所有. "
 #: audits/models.py:105 authentication/forms.py:15 authentication/forms.py:17
 #: ops/models/adhoc.py:148 users/forms/profile.py:31 users/models/user.py:602
 #: users/templates/users/_select_user_modal.html:14
-#: xpack/plugins/change_auth_plan/models.py:47
-#: xpack/plugins/change_auth_plan/models.py:278
-#: xpack/plugins/cloud/serializers.py:67
+#: xpack/plugins/change_auth_plan/models/asset.py:35
+#: xpack/plugins/change_auth_plan/models/asset.py:191
+#: xpack/plugins/cloud/serializers/account_attrs.py:62
 msgid "Username"
 msgstr "用户名"
 
@@ -234,6 +234,7 @@ msgstr "我的应用"
 #: applications/const.py:8 applications/models/account.py:10
 #: applications/serializers/attrs/application_category/db.py:14
 #: applications/serializers/attrs/application_type/mysql_workbench.py:26
+#: xpack/plugins/change_auth_plan/models/app.py:32
 msgid "Database"
 msgstr "数据库"
 
@@ -247,7 +248,7 @@ msgstr "自定义"
 
 #: applications/models/account.py:11 assets/models/authbook.py:16
 #: assets/models/user.py:281 audits/models.py:39
-#: perms/models/application_permission.py:31
+#: perms/models/application_permission.py:32
 #: perms/models/asset_permission.py:101 templates/_nav.html:45
 #: terminal/backends/command/models.py:20
 #: terminal/backends/command/serializers.py:14 terminal/models/session.py:42
@@ -257,6 +258,8 @@ msgstr "自定义"
 #: users/templates/users/user_asset_permission.html:159
 #: users/templates/users/user_database_app_permission.html:40
 #: users/templates/users/user_database_app_permission.html:67
+#: xpack/plugins/change_auth_plan/models/app.py:36
+#: xpack/plugins/change_auth_plan/models/app.py:142
 msgid "System user"
 msgstr "系统用户"
 
@@ -266,7 +269,7 @@ msgid "Version"
 msgstr "版本"
 
 #: applications/models/account.py:18 xpack/plugins/cloud/models.py:82
-#: xpack/plugins/cloud/serializers.py:204
+#: xpack/plugins/cloud/serializers/task.py:65
 msgid "Account"
 msgstr "账户"
 
@@ -275,20 +278,23 @@ msgid "Applications"
 msgstr "应用管理"
 
 #: applications/models/application.py:168
-#: applications/serializers/application.py:82 assets/models/label.py:21
+#: applications/serializers/application.py:88 assets/models/label.py:21
 #: perms/models/application_permission.py:20
 #: perms/serializers/application/user_permission.py:33
 #: tickets/serializers/ticket/meta/ticket_type/apply_application.py:20
+#: xpack/plugins/change_auth_plan/models/app.py:25
 msgid "Category"
 msgstr "类别"
 
 #: applications/models/application.py:171
-#: applications/serializers/application.py:84 assets/models/cmd_filter.py:53
+#: applications/serializers/application.py:90 assets/models/cmd_filter.py:53
 #: assets/models/user.py:206 perms/models/application_permission.py:23
 #: perms/serializers/application/user_permission.py:34
 #: terminal/models/storage.py:55 terminal/models/storage.py:116
-#: tickets/models/flow.py:50 tickets/models/ticket.py:48
+#: tickets/models/flow.py:51 tickets/models/ticket.py:48
 #: tickets/serializers/ticket/meta/ticket_type/apply_application.py:27
+#: xpack/plugins/change_auth_plan/models/app.py:28
+#: xpack/plugins/change_auth_plan/models/app.py:148
 msgid "Type"
 msgstr "类型"
 
@@ -302,23 +308,23 @@ msgid "Attrs"
 msgstr ""
 
 #: applications/serializers/application.py:59
-#: applications/serializers/application.py:83 assets/serializers/label.py:13
+#: applications/serializers/application.py:89 assets/serializers/label.py:13
 #: perms/serializers/application/permission.py:16
 #: tickets/serializers/ticket/meta/ticket_type/apply_application.py:24
 msgid "Category display"
 msgstr "类别名称"
 
 #: applications/serializers/application.py:60
-#: applications/serializers/application.py:85
+#: applications/serializers/application.py:91
 #: assets/serializers/system_user.py:26 audits/serializers.py:29
 #: perms/serializers/application/permission.py:17
 #: tickets/serializers/ticket/meta/ticket_type/apply_application.py:31
 #: tickets/serializers/ticket/ticket.py:22
-#: tickets/serializers/ticket/ticket.py:162
+#: tickets/serializers/ticket/ticket.py:168
 msgid "Type display"
 msgstr "类型名称"
 
-#: applications/serializers/application.py:101
+#: applications/serializers/application.py:107
 msgid "Application display"
 msgstr "应用名称"
 
@@ -329,7 +335,7 @@ msgstr "集群"
 
 #: applications/serializers/attrs/application_category/db.py:11
 #: ops/models/adhoc.py:146 settings/serializers/auth/radius.py:14
-#: xpack/plugins/cloud/serializers.py:65
+#: xpack/plugins/cloud/serializers/account_attrs.py:60
 msgid "Host"
 msgstr "主机"
 
@@ -339,7 +345,8 @@ msgstr "主机"
 #: applications/serializers/attrs/application_type/oracle.py:11
 #: applications/serializers/attrs/application_type/pgsql.py:11
 #: assets/models/asset.py:185 assets/models/domain.py:62
-#: settings/serializers/auth/radius.py:15 xpack/plugins/cloud/serializers.py:66
+#: settings/serializers/auth/radius.py:15
+#: xpack/plugins/cloud/serializers/account_attrs.py:61
 msgid "Port"
 msgstr "端口"
 
@@ -351,6 +358,11 @@ msgid "Application path"
 msgstr "应用路径"
 
 #: applications/serializers/attrs/application_category/remote_app.py:45
+#: xpack/plugins/change_auth_plan/serializers/asset.py:65
+#: xpack/plugins/change_auth_plan/serializers/asset.py:68
+#: xpack/plugins/change_auth_plan/serializers/asset.py:71
+#: xpack/plugins/change_auth_plan/serializers/asset.py:87
+#: xpack/plugins/cloud/serializers/account_attrs.py:44
 msgid "This field is required."
 msgstr "该字段是必填项。"
 
@@ -363,17 +375,17 @@ msgstr "目标URL"
 #: applications/serializers/attrs/application_type/custom.py:25
 #: applications/serializers/attrs/application_type/mysql_workbench.py:34
 #: applications/serializers/attrs/application_type/vmware_client.py:30
-#: assets/models/base.py:177 audits/signals_handler.py:63
+#: assets/models/base.py:177 audits/signals_handler.py:65
 #: authentication/forms.py:22
 #: authentication/templates/authentication/login.html:164
 #: settings/serializers/auth/ldap.py:44 users/forms/profile.py:21
 #: users/templates/users/user_otp_check_password.html:13
 #: users/templates/users/user_password_update.html:43
 #: users/templates/users/user_password_verify.html:18
-#: xpack/plugins/change_auth_plan/models.py:68
-#: xpack/plugins/change_auth_plan/models.py:190
-#: xpack/plugins/change_auth_plan/models.py:285
-#: xpack/plugins/cloud/serializers.py:69
+#: xpack/plugins/change_auth_plan/models/base.py:39
+#: xpack/plugins/change_auth_plan/models/base.py:114
+#: xpack/plugins/change_auth_plan/models/base.py:182
+#: xpack/plugins/cloud/serializers/account_attrs.py:64
 msgid "Password"
 msgstr "密码"
 
@@ -425,13 +437,13 @@ msgstr "系统平台"
 
 #: assets/models/asset.py:186 assets/serializers/asset.py:65
 #: perms/serializers/asset/user_permission.py:41
-#: xpack/plugins/cloud/models.py:99 xpack/plugins/cloud/serializers.py:183
+#: xpack/plugins/cloud/models.py:104 xpack/plugins/cloud/serializers/task.py:42
 msgid "Protocols"
 msgstr "协议组"
 
 #: assets/models/asset.py:189 assets/models/user.py:198
 #: perms/models/asset_permission.py:100
-#: xpack/plugins/change_auth_plan/models.py:56
+#: xpack/plugins/change_auth_plan/models/asset.py:44
 #: xpack/plugins/gathered_user/models.py:24
 msgid "Nodes"
 msgstr "节点"
@@ -444,7 +456,6 @@ msgstr "激活"
 
 #: assets/models/asset.py:193 assets/models/cluster.py:19
 #: assets/models/user.py:195 assets/models/user.py:330 templates/_nav.html:44
-#: xpack/plugins/cloud/models.py:96 xpack/plugins/cloud/serializers.py:205
 msgid "Admin user"
 msgstr "特权用户"
 
@@ -521,8 +532,9 @@ msgstr "标签管理"
 #: assets/models/cmd_filter.py:67 assets/models/group.py:21
 #: common/db/models.py:70 common/mixins/models.py:49 orgs/models.py:25
 #: orgs/models.py:437 perms/models/base.py:51 users/models/user.py:645
-#: users/serializers/group.py:33 xpack/plugins/change_auth_plan/models.py:81
-#: xpack/plugins/cloud/models.py:114 xpack/plugins/gathered_user/models.py:30
+#: users/serializers/group.py:33
+#: xpack/plugins/change_auth_plan/models/base.py:45
+#: xpack/plugins/cloud/models.py:119 xpack/plugins/gathered_user/models.py:30
 msgid "Created by"
 msgstr "创建者"
 
@@ -532,7 +544,7 @@ msgstr "创建者"
 #: assets/models/label.py:25 common/db/models.py:72 common/mixins/models.py:50
 #: ops/models/adhoc.py:38 ops/models/command.py:29 orgs/models.py:26
 #: orgs/models.py:435 perms/models/base.py:52 users/models/group.py:18
-#: users/models/user.py:836 xpack/plugins/cloud/models.py:117
+#: users/models/user.py:836 xpack/plugins/cloud/models.py:122
 msgid "Date created"
 msgstr "创建日期"
 
@@ -549,7 +561,7 @@ msgid "Ok"
 msgstr "成功"
 
 #: assets/models/base.py:32 audits/models.py:102
-#: xpack/plugins/cloud/const.py:27
+#: xpack/plugins/cloud/const.py:28
 msgid "Failed"
 msgstr "失败"
 
@@ -561,15 +573,15 @@ msgstr "可连接性"
 msgid "Date verified"
 msgstr "校验日期"
 
-#: assets/models/base.py:178 xpack/plugins/change_auth_plan/models.py:72
-#: xpack/plugins/change_auth_plan/models.py:197
-#: xpack/plugins/change_auth_plan/models.py:292
+#: assets/models/base.py:178 xpack/plugins/change_auth_plan/models/asset.py:54
+#: xpack/plugins/change_auth_plan/models/asset.py:126
+#: xpack/plugins/change_auth_plan/models/asset.py:202
 msgid "SSH private key"
 msgstr "SSH密钥"
 
-#: assets/models/base.py:179 xpack/plugins/change_auth_plan/models.py:75
-#: xpack/plugins/change_auth_plan/models.py:193
-#: xpack/plugins/change_auth_plan/models.py:288
+#: assets/models/base.py:179 xpack/plugins/change_auth_plan/models/asset.py:57
+#: xpack/plugins/change_auth_plan/models/asset.py:122
+#: xpack/plugins/change_auth_plan/models/asset.py:198
 msgid "SSH public key"
 msgstr "SSH公钥"
 
@@ -666,15 +678,19 @@ msgstr "命令复核"
 msgid "Gateway"
 msgstr "网关"
 
-#: assets/models/domain.py:127
+#: assets/models/domain.py:128
 #, python-brace-format
 msgid "Unable to connect to port {port} on {ip}"
 msgstr "无法连接到 {ip} 上的端口 {port}"
 
-#: assets/models/domain.py:130
+#: assets/models/domain.py:131
 msgid "Authentication failed"
 msgstr "认证失败"
 
+#: assets/models/domain.py:133
+msgid "Connect failed"
+msgstr "连接失败"
+
 #: assets/models/gathered_user.py:16
 msgid "Present"
 msgstr "存在"
@@ -723,11 +739,11 @@ msgstr "全称"
 msgid "Parent key"
 msgstr "ssh私钥"
 
-#: assets/models/node.py:559 assets/serializers/system_user.py:200
+#: assets/models/node.py:559 assets/serializers/system_user.py:206
 #: users/templates/users/user_asset_permission.html:41
 #: users/templates/users/user_asset_permission.html:73
 #: users/templates/users/user_asset_permission.html:158
-#: xpack/plugins/cloud/models.py:93 xpack/plugins/cloud/serializers.py:206
+#: xpack/plugins/cloud/models.py:93 xpack/plugins/cloud/serializers/task.py:68
 msgid "Node"
 msgstr "节点"
 
@@ -748,7 +764,7 @@ msgid "Username same with user"
 msgstr "用户名与用户相同"
 
 #: assets/models/user.py:200 assets/serializers/domain.py:28
-#: templates/_nav.html:39 xpack/plugins/change_auth_plan/models.py:52
+#: templates/_nav.html:39 xpack/plugins/change_auth_plan/models/asset.py:40
 msgid "Assets"
 msgstr "资产"
 
@@ -781,7 +797,7 @@ msgstr "认证方式"
 msgid "SFTP Root"
 msgstr "SFTP根路径"
 
-#: assets/models/user.py:215 authentication/models.py:94
+#: assets/models/user.py:215 authentication/models.py:98
 msgid "Token"
 msgstr ""
 
@@ -822,7 +838,7 @@ msgstr "节点名称"
 msgid "Hardware info"
 msgstr "硬件信息"
 
-#: assets/serializers/asset.py:98 assets/serializers/system_user.py:218
+#: assets/serializers/asset.py:98 assets/serializers/system_user.py:225
 #: orgs/mixins/serializers.py:26
 msgid "Org name"
 msgstr "用户名"
@@ -871,7 +887,7 @@ msgstr "密钥指纹"
 msgid "Nodes amount"
 msgstr "节点数量"
 
-#: assets/serializers/system_user.py:53 assets/serializers/system_user.py:202
+#: assets/serializers/system_user.py:53 assets/serializers/system_user.py:208
 msgid "Login mode display"
 msgstr "认证方式名称"
 
@@ -899,11 +915,11 @@ msgstr "路径应该以 / 开头"
 msgid "Password or private key required"
 msgstr "密码或密钥密码需要一个"
 
-#: assets/serializers/system_user.py:217
+#: assets/serializers/system_user.py:224
 msgid "System user name"
 msgstr "系统用户名称"
 
-#: assets/serializers/system_user.py:227
+#: assets/serializers/system_user.py:234
 msgid "Asset hostname"
 msgstr "资产主机名"
 
@@ -1077,8 +1093,8 @@ msgstr "成功"
 #: terminal/models/session.py:52
 #: tickets/serializers/ticket/meta/ticket_type/apply_application.py:53
 #: tickets/serializers/ticket/meta/ticket_type/apply_asset.py:45
-#: xpack/plugins/change_auth_plan/models.py:177
-#: xpack/plugins/change_auth_plan/models.py:307
+#: xpack/plugins/change_auth_plan/models/base.py:105
+#: xpack/plugins/change_auth_plan/models/base.py:189
 #: xpack/plugins/gathered_user/models.py:76
 msgid "Date start"
 msgstr "开始日期"
@@ -1150,13 +1166,13 @@ msgid "MFA"
 msgstr "多因子认证"
 
 #: audits/models.py:111 terminal/models/sharing.py:88
-#: xpack/plugins/change_auth_plan/models.py:303
-#: xpack/plugins/cloud/models.py:171
+#: xpack/plugins/change_auth_plan/models/base.py:187
+#: xpack/plugins/cloud/models.py:176
 msgid "Reason"
 msgstr "原因"
 
 #: audits/models.py:112 tickets/models/ticket.py:57
-#: xpack/plugins/cloud/models.py:167 xpack/plugins/cloud/models.py:216
+#: xpack/plugins/cloud/models.py:172 xpack/plugins/cloud/models.py:221
 msgid "Status"
 msgstr "状态"
 
@@ -1190,7 +1206,7 @@ msgid "Hosts display"
 msgstr "主机名称"
 
 #: audits/serializers.py:89 ops/models/command.py:26
-#: xpack/plugins/cloud/models.py:165
+#: xpack/plugins/cloud/models.py:170
 msgid "Result"
 msgstr "结果"
 
@@ -1210,212 +1226,212 @@ msgstr "运行用户名称"
 msgid "User display"
 msgstr "用户名称"
 
-#: audits/signals_handler.py:62
+#: audits/signals_handler.py:64
 msgid "SSH Key"
 msgstr "SSH 密钥"
 
-#: audits/signals_handler.py:64
+#: audits/signals_handler.py:66
 msgid "SSO"
 msgstr ""
 
-#: audits/signals_handler.py:65
+#: audits/signals_handler.py:67
 msgid "Auth Token"
 msgstr "认证令牌"
 
-#: audits/signals_handler.py:66
+#: audits/signals_handler.py:68
 #: authentication/templates/authentication/login.html:210
 #: notifications/backends/__init__.py:11
 msgid "WeCom"
 msgstr "企业微信"
 
-#: audits/signals_handler.py:67
+#: audits/signals_handler.py:69
 #: authentication/templates/authentication/login.html:215
 #: notifications/backends/__init__.py:12
 msgid "DingTalk"
 msgstr "钉钉"
 
-#: audits/signals_handler.py:100
+#: audits/signals_handler.py:102
 msgid "User and Organization"
 msgstr "用户与组织"
 
-#: audits/signals_handler.py:101
+#: audits/signals_handler.py:103
 #, python-brace-format
-msgid "{User} *JOINED* {Organization}"
-msgstr "{User} *加入了* {Organization}"
+msgid "{User} JOINED {Organization}"
+msgstr "{User} 加入 {Organization}"
 
-#: audits/signals_handler.py:102
+#: audits/signals_handler.py:104
 #, python-brace-format
-msgid "{User} *LEFT* {Organization}"
-msgstr "{User} *离开了* {Organization}"
+msgid "{User} LEFT {Organization}"
+msgstr "{User} 离开 {Organization}"
 
-#: audits/signals_handler.py:105
+#: audits/signals_handler.py:107
 msgid "User and Group"
 msgstr "用户与用户组"
 
-#: audits/signals_handler.py:106
+#: audits/signals_handler.py:108
 #, python-brace-format
-msgid "{User} *JOINED* {UserGroup}"
-msgstr "{User} *加入了* {UserGroup}"
+msgid "{User} JOINED {UserGroup}"
+msgstr "{User} 加入 {UserGroup}"
 
-#: audits/signals_handler.py:107
+#: audits/signals_handler.py:109
 #, python-brace-format
-msgid "{User} *LEFT* {UserGroup}"
-msgstr "{User} *离开了* {UserGroup}"
+msgid "{User} LEFT {UserGroup}"
+msgstr "{User} 离开 {UserGroup}"
 
-#: audits/signals_handler.py:110
+#: audits/signals_handler.py:112
 msgid "Asset and SystemUser"
 msgstr "资产与系统用户"
 
-#: audits/signals_handler.py:111
+#: audits/signals_handler.py:113
 #, python-brace-format
-msgid "{Asset} *ADD* {SystemUser}"
-msgstr "{Asset} *添加了* {SystemUser}"
+msgid "{Asset} ADD {SystemUser}"
+msgstr "{Asset} 添加 {SystemUser}"
 
-#: audits/signals_handler.py:112
+#: audits/signals_handler.py:114
 #, python-brace-format
-msgid "{Asset} *REMOVE* {SystemUser}"
-msgstr "{Asset} *移除了* {SystemUser}"
+msgid "{Asset} REMOVE {SystemUser}"
+msgstr "{Asset} 移除 {SystemUser}"
 
-#: audits/signals_handler.py:115
+#: audits/signals_handler.py:117
 msgid "Node and Asset"
 msgstr "节点与资产"
 
-#: audits/signals_handler.py:116
+#: audits/signals_handler.py:118
 #, python-brace-format
-msgid "{Node} *ADD* {Asset}"
-msgstr "{Node} *添加了* {Asset}"
+msgid "{Node} ADD {Asset}"
+msgstr "{Node} 添加 {Asset}"
 
-#: audits/signals_handler.py:117
+#: audits/signals_handler.py:119
 #, python-brace-format
-msgid "{Node} *REMOVE* {Asset}"
-msgstr "{Node} *移除了* {Asset}"
+msgid "{Node} REMOVE {Asset}"
+msgstr "{Node} 移除 {Asset}"
 
-#: audits/signals_handler.py:120
+#: audits/signals_handler.py:122
 msgid "User asset permissions"
 msgstr "用户资产授权"
 
-#: audits/signals_handler.py:121
+#: audits/signals_handler.py:123
 #, python-brace-format
-msgid "{AssetPermission} *ADD* {User}"
-msgstr "{AssetPermission} *添加了* {User}"
+msgid "{AssetPermission} ADD {User}"
+msgstr "{AssetPermission} 添加 {User}"
 
-#: audits/signals_handler.py:122
+#: audits/signals_handler.py:124
 #, python-brace-format
-msgid "{AssetPermission} *REMOVE* {User}"
-msgstr "{AssetPermission} *移除了* {User}"
+msgid "{AssetPermission} REMOVE {User}"
+msgstr "{AssetPermission} 移除 {User}"
 
-#: audits/signals_handler.py:125
+#: audits/signals_handler.py:127
 msgid "User group asset permissions"
 msgstr "用户组资产授权"
 
-#: audits/signals_handler.py:126
+#: audits/signals_handler.py:128
 #, python-brace-format
-msgid "{AssetPermission} *ADD* {UserGroup}"
-msgstr "{AssetPermission} *添加了* {UserGroup}"
+msgid "{AssetPermission} ADD {UserGroup}"
+msgstr "{AssetPermission} 添加 {UserGroup}"
 
-#: audits/signals_handler.py:127
+#: audits/signals_handler.py:129
 #, python-brace-format
-msgid "{AssetPermission} *REMOVE* {UserGroup}"
-msgstr "{AssetPermission} *移除了* {UserGroup}"
+msgid "{AssetPermission} REMOVE {UserGroup}"
+msgstr "{AssetPermission} 移除 {UserGroup}"
 
-#: audits/signals_handler.py:130 perms/models/asset_permission.py:106
+#: audits/signals_handler.py:132 perms/models/asset_permission.py:106
 #: templates/_nav.html:78 users/templates/users/_user_detail_nav_header.html:31
 msgid "Asset permission"
 msgstr "资产授权"
 
-#: audits/signals_handler.py:131
+#: audits/signals_handler.py:133
 #, python-brace-format
-msgid "{AssetPermission} *ADD* {Asset}"
-msgstr "{AssetPermission} *添加了* {Asset}"
+msgid "{AssetPermission} ADD {Asset}"
+msgstr "{AssetPermission} 添加 {Asset}"
 
-#: audits/signals_handler.py:132
+#: audits/signals_handler.py:134
 #, python-brace-format
-msgid "{AssetPermission} *REMOVE* {Asset}"
-msgstr "{AssetPermission} *移除了* {Asset}"
+msgid "{AssetPermission} REMOVE {Asset}"
+msgstr "{AssetPermission} 移除 {Asset}"
 
-#: audits/signals_handler.py:135
+#: audits/signals_handler.py:137
 msgid "Node permission"
 msgstr "节点授权"
 
-#: audits/signals_handler.py:136
+#: audits/signals_handler.py:138
 #, python-brace-format
-msgid "{AssetPermission} *ADD* {Node}"
-msgstr "{AssetPermission} *添加了* {Node}"
+msgid "{AssetPermission} ADD {Node}"
+msgstr "{AssetPermission} 添加 {Node}"
 
-#: audits/signals_handler.py:137
+#: audits/signals_handler.py:139
 #, python-brace-format
-msgid "{AssetPermission} *REMOVE* {Node}"
-msgstr "{AssetPermission} *移除了* {Node}"
+msgid "{AssetPermission} REMOVE {Node}"
+msgstr "{AssetPermission} 移除 {Node}"
 
-#: audits/signals_handler.py:140
+#: audits/signals_handler.py:142
 msgid "Asset permission and SystemUser"
 msgstr "资产授权与系统用户"
 
-#: audits/signals_handler.py:141
+#: audits/signals_handler.py:143
 #, python-brace-format
-msgid "{AssetPermission} *ADD* {SystemUser}"
-msgstr "{AssetPermission} *添加了* {SystemUser}"
+msgid "{AssetPermission} ADD {SystemUser}"
+msgstr "{AssetPermission} 添加 {SystemUser}"
 
-#: audits/signals_handler.py:142
+#: audits/signals_handler.py:144
 #, python-brace-format
-msgid "{AssetPermission} *REMOVE* {SystemUser}"
-msgstr "{AssetPermission} *移除了* {SystemUser}"
+msgid "{AssetPermission} REMOVE {SystemUser}"
+msgstr "{AssetPermission} 移除 {SystemUser}"
 
-#: audits/signals_handler.py:145
+#: audits/signals_handler.py:147
 msgid "User application permissions"
 msgstr "用户应用授权"
 
-#: audits/signals_handler.py:146
+#: audits/signals_handler.py:148
 #, python-brace-format
-msgid "{ApplicationPermission} *ADD* {User}"
-msgstr "{ApplicationPermission} *添加了* {User}"
+msgid "{ApplicationPermission} ADD {User}"
+msgstr "{ApplicationPermission} 添加 {User}"
 
-#: audits/signals_handler.py:147
+#: audits/signals_handler.py:149
 #, python-brace-format
-msgid "{ApplicationPermission} *REMOVE* {User}"
-msgstr "{ApplicationPermission} *移除了* {User}"
+msgid "{ApplicationPermission} REMOVE {User}"
+msgstr "{ApplicationPermission} 移除 {User}"
 
-#: audits/signals_handler.py:150
+#: audits/signals_handler.py:152
 msgid "User group application permissions"
 msgstr "用户组应用授权"
 
-#: audits/signals_handler.py:151
+#: audits/signals_handler.py:153
 #, python-brace-format
-msgid "{ApplicationPermission} *ADD* {UserGroup}"
-msgstr "{ApplicationPermission} *添加了* {UserGroup}"
+msgid "{ApplicationPermission} ADD {UserGroup}"
+msgstr "{ApplicationPermission} 添加 {UserGroup}"
 
-#: audits/signals_handler.py:152
+#: audits/signals_handler.py:154
 #, python-brace-format
-msgid "{ApplicationPermission} *REMOVE* {UserGroup}"
-msgstr "{ApplicationPermission} *移除了* {UserGroup}"
+msgid "{ApplicationPermission} REMOVE {UserGroup}"
+msgstr "{ApplicationPermission} 移除 {UserGroup}"
 
-#: audits/signals_handler.py:155 perms/models/application_permission.py:36
+#: audits/signals_handler.py:157 perms/models/application_permission.py:37
 msgid "Application permission"
 msgstr "应用管理"
 
-#: audits/signals_handler.py:156
+#: audits/signals_handler.py:158
 #, python-brace-format
-msgid "{ApplicationPermission} *ADD* {Application}"
-msgstr "{ApplicationPermission} *添加了* {Application}"
+msgid "{ApplicationPermission} ADD {Application}"
+msgstr "{ApplicationPermission} 添加 {Application}"
 
-#: audits/signals_handler.py:157
+#: audits/signals_handler.py:159
 #, python-brace-format
-msgid "{ApplicationPermission} *REMOVE* {Application}"
-msgstr "{ApplicationPermission} *移除了* {Application}"
+msgid "{ApplicationPermission} REMOVE {Application}"
+msgstr "{ApplicationPermission} 移除 {Application}"
 
-#: audits/signals_handler.py:160
+#: audits/signals_handler.py:162
 msgid "Application permission and SystemUser"
 msgstr "应用授权与系统用户"
 
-#: audits/signals_handler.py:161
+#: audits/signals_handler.py:163
 #, python-brace-format
-msgid "{ApplicationPermission} *ADD* {SystemUser}"
-msgstr "{ApplicationPermission} *添加了* {SystemUser}"
+msgid "{ApplicationPermission} ADD {SystemUser}"
+msgstr "{ApplicationPermission} 添加 {SystemUser}"
 
-#: audits/signals_handler.py:162
+#: audits/signals_handler.py:164
 #, python-brace-format
-msgid "{ApplicationPermission} *REMOVE* {SystemUser}"
-msgstr "{ApplicationPermission} *移除了* {SystemUser}"
+msgid "{ApplicationPermission} REMOVE {SystemUser}"
+msgstr "{ApplicationPermission} 移除 {SystemUser}"
 
 #: authentication/api/connection_token.py:226
 msgid "Invalid token"
@@ -1545,6 +1561,7 @@ msgid ""
 msgstr "账号已被锁定（请联系管理员解锁 或 {}分钟后重试）"
 
 #: authentication/errors.py:64
+#, python-brace-format
 msgid ""
 "One-time password invalid, or ntp sync server time, You can also try "
 "{times_try} times (The account will be temporarily locked for {block_time} "
@@ -1554,20 +1571,22 @@ msgstr ""
 "临时 锁定 {block_time} 分钟）"
 
 #: authentication/errors.py:69
+#, python-brace-format
 msgid ""
 "SMS verify code invalid,You can also try {times_try} times (The account will "
 "be temporarily locked for {block_time} minutes)"
 msgstr ""
-"短信验证码不正确，或者服务器端时间不对。 您还可以尝试 {times_try} 次（账号将被"
-"临时 锁定 {block_time} 分钟）"
+"短信验证码不正确。 您还可以尝试 {times_try} 次（账号将被临时 锁定 "
+"{block_time} 分钟）"
 
 #: authentication/errors.py:74
+#, python-brace-format
 msgid ""
-"The MFA type({mfa_type}) is not supported, You can also try {times_try} times "
-"(The account will be temporarily locked for {block_time} minutes)"
+"The MFA type({mfa_type}) is not supported, You can also try {times_try} "
+"times (The account will be temporarily locked for {block_time} minutes)"
 msgstr ""
-"该({mfa_type}) MFA 类型不支持。 您还可以尝试 {times_try} 次（账号将被"
-"临时 锁定 {block_time} 分钟）"
+"该({mfa_type}) MFA 类型不支持， 您还可以尝试 {times_try} 次（账号将被临时 锁"
+"定 {block_time} 分钟）"
 
 #: authentication/errors.py:79
 msgid "MFA required"
@@ -1638,7 +1657,15 @@ msgstr "请修改密码"
 msgid "Private Token"
 msgstr "SSH密钥"
 
-#: authentication/models.py:95
+#: authentication/models.py:49 settings/serializers/security.py:115
+msgid "Login Confirm"
+msgstr "登录复核"
+
+#: authentication/models.py:90
+msgid "{} need confirm by {}"
+msgstr "{} 需要 {} 复核"
+
+#: authentication/models.py:99
 msgid "Expired"
 msgstr "过期时间"
 
@@ -1765,11 +1792,12 @@ msgstr "CAS"
 msgid "FeiShu"
 msgstr "飞书"
 
-#: authentication/templates/authentication/login_otp.html:25
+#: authentication/templates/authentication/login_otp.html:24
 msgid "Please enter the verification code"
 msgstr "请输入验证码"
 
-#: authentication/templates/authentication/login_otp.html:28
+#: authentication/templates/authentication/login_otp.html:25
+#: authentication/templates/authentication/login_otp.html:75
 msgid "Send verification code"
 msgstr "发送验证码"
 
@@ -1781,10 +1809,19 @@ msgstr "发送验证码"
 msgid "Next"
 msgstr "下一步"
 
-#: authentication/templates/authentication/login_otp.html:32
+#: authentication/templates/authentication/login_otp.html:31
 msgid "Can't provide security? Please contact the administrator!"
 msgstr "如果不能提供多因子认证验证码，请联系管理员!"
 
+#: authentication/templates/authentication/login_otp.html:68
+#: authentication/templates/authentication/login_otp.html:73
+msgid "Wait: "
+msgstr "等待："
+
+#: authentication/templates/authentication/login_otp.html:81
+msgid "The verification code has been sent"
+msgstr "验证码已发送"
+
 #: authentication/templates/authentication/login_wait_confirm.html:41
 msgid "Refresh"
 msgstr "刷新"
@@ -1905,7 +1942,7 @@ msgstr "正在跳转到 {} 认证"
 msgid "Please enable cookies and try again."
 msgstr "设置你的浏览器支持cookie"
 
-#: authentication/views/login.py:215
+#: authentication/views/login.py:217
 msgid ""
 "Wait for <b>{}</b> confirm, You also can copy link to her/him <br/>\n"
 "                  Don't close this page"
@@ -1913,15 +1950,15 @@ msgstr ""
 "等待 <b>{}</b> 确认, 你也可以复制链接发给他/她 <br/>\n"
 "                  不要关闭本页面"
 
-#: authentication/views/login.py:220
+#: authentication/views/login.py:222
 msgid "No ticket found"
 msgstr "没有发现工单"
 
-#: authentication/views/login.py:252
+#: authentication/views/login.py:254
 msgid "Logout success"
 msgstr "退出登录成功"
 
-#: authentication/views/login.py:253
+#: authentication/views/login.py:255
 msgid "Logout success, return login page"
 msgstr "退出登录成功，返回到登录页面"
 
@@ -1929,7 +1966,7 @@ msgstr "退出登录成功，返回到登录页面"
 msgid "One-time password"
 msgstr "一次性密码"
 
-#: authentication/views/mfa.py:50 notifications/backends/__init__.py:15
+#: authentication/views/mfa.py:50
 msgid "SMS"
 msgstr "短信"
 
@@ -2057,18 +2094,22 @@ msgstr "加密的字段"
 msgid "Network error, please contact system administrator"
 msgstr "网络错误，请联系系统管理员"
 
-#: common/message/backends/sms/__init__.py:38
-msgid "Invalid SMS sign and template: {}"
-msgstr "无效的短信签名和模版: {}"
-
-#: common/message/backends/sms/__init__.py:43
-msgid "Alibaba"
+#: common/message/backends/sms/__init__.py:15
+msgid "Alibaba cloud"
 msgstr "阿里云"
 
-#: common/message/backends/sms/__init__.py:44
-msgid "Tencent"
+#: common/message/backends/sms/__init__.py:16
+msgid "Tencent cloud"
 msgstr "腾讯云"
 
+#: common/message/backends/sms/__init__.py:42
+msgid "SMS provider not support: {}"
+msgstr "短信服务商不支持：{}"
+
+#: common/message/backends/sms/__init__.py:63
+msgid "SMS verification code signature or template invalid"
+msgstr "短信验证码签名或模版无效"
+
 #: common/message/backends/sms/alibaba.py:56
 msgid "Signature does not match"
 msgstr "签名不匹配"
@@ -2145,6 +2186,14 @@ msgstr "邮件"
 msgid "Site message"
 msgstr "站内信"
 
+#: notifications/notifications.py:126
+msgid ""
+"\n"
+"Time: {}"
+msgstr ""
+"\n"
+"时间：{}"
+
 #: ops/api/celery.py:61 ops/api/celery.py:76
 msgid "Waiting task start"
 msgstr "等待任务开始"
@@ -2167,7 +2216,7 @@ msgid "Regularly perform"
 msgstr "定期执行"
 
 #: ops/mixin.py:106 ops/mixin.py:147
-#: xpack/plugins/change_auth_plan/serializers.py:55
+#: xpack/plugins/change_auth_plan/serializers/base.py:42
 msgid "Periodic perform"
 msgstr "定时执行"
 
@@ -2246,8 +2295,8 @@ msgstr "开始时间"
 msgid "End time"
 msgstr "完成时间"
 
-#: ops/models/adhoc.py:246 xpack/plugins/change_auth_plan/models.py:180
-#: xpack/plugins/change_auth_plan/models.py:310
+#: ops/models/adhoc.py:246 xpack/plugins/change_auth_plan/models/base.py:108
+#: xpack/plugins/change_auth_plan/models/base.py:190
 #: xpack/plugins/gathered_user/models.py:79
 msgid "Time"
 msgstr "时间"
@@ -2491,8 +2540,8 @@ msgstr "系统用户名称"
 msgid "test_phone is required"
 msgstr "测试手机号 该字段是必填项。"
 
-#: settings/api/alibaba_sms.py:52 settings/api/dingtalk.py:36
-#: settings/api/feishu.py:35 settings/api/tencent_sms.py:57
+#: settings/api/alibaba_sms.py:51 settings/api/dingtalk.py:36
+#: settings/api/feishu.py:35 settings/api/tencent_sms.py:56
 #: settings/api/wecom.py:36
 msgid "Test success"
 msgstr "测试成功"
@@ -2546,15 +2595,11 @@ msgstr "企业微信 认证"
 msgid "SSO Auth"
 msgstr "SSO Token 认证"
 
-#: settings/serializers/auth/base.py:18 settings/serializers/basic.py:15
+#: settings/serializers/auth/base.py:19 settings/serializers/basic.py:15
 msgid "Forgot password url"
 msgstr "忘记密码 URL"
 
-#: settings/serializers/auth/base.py:21
-msgid "Health check token"
-msgstr "健康检查 Token"
-
-#: settings/serializers/auth/base.py:24
+#: settings/serializers/auth/base.py:25
 msgid "Enable login redirect msg"
 msgstr "启用登录跳转提示"
 
@@ -2635,7 +2680,8 @@ msgstr ""
 "用户属性映射代表怎样将LDAP中用户属性映射到jumpserver用户上，username, name,"
 "email 是jumpserver的用户需要属性"
 
-#: settings/serializers/auth/ldap.py:58 xpack/plugins/cloud/serializers.py:207
+#: settings/serializers/auth/ldap.py:58
+#: xpack/plugins/cloud/serializers/task.py:69
 #: xpack/plugins/gathered_user/serializers.py:20
 msgid "Periodic display"
 msgstr "定时执行"
@@ -2660,7 +2706,8 @@ msgstr "JumpServer 地址"
 msgid "Client Id"
 msgstr "客户端 ID"
 
-#: settings/serializers/auth/oidc.py:18 xpack/plugins/cloud/serializers.py:33
+#: settings/serializers/auth/oidc.py:18
+#: xpack/plugins/cloud/serializers/account_attrs.py:26
 msgid "Client Secret"
 msgstr "客户端密钥"
 
@@ -2752,27 +2799,24 @@ msgstr "使用 Radius OTP"
 msgid "Enable SMS"
 msgstr "启用 SMS"
 
-#: settings/serializers/auth/sms.py:11
+#: settings/serializers/auth/sms.py:12
+msgid "SMS provider"
+msgstr "短信服务商"
+
+#: settings/serializers/auth/sms.py:17 settings/serializers/auth/sms.py:35
+#: settings/serializers/auth/sms.py:43 settings/serializers/email.py:69
+msgid "Signature"
+msgstr "签名"
+
+#: settings/serializers/auth/sms.py:18 settings/serializers/auth/sms.py:36
+#: settings/serializers/auth/sms.py:44
+msgid "Template code"
+msgstr "模板"
+
+#: settings/serializers/auth/sms.py:22
 msgid "Test phone"
 msgstr "测试手机号"
 
-#: settings/serializers/auth/sms.py:25 settings/serializers/auth/sms.py:43
-msgid "Signatures and Templates"
-msgstr "签名和模版"
-
-#: settings/serializers/auth/sms.py:25 settings/serializers/auth/sms.py:43
-msgid ""
-"\n"
-"        Filling in JSON Data: \n"
-"        {\n"
-"            \"verification_code\": {\n"
-"                \"sign_name\": \"<Your signature name>\", \n"
-"                \"template_code\": \"<Your template code>\"\n"
-"            }\n"
-"        }\n"
-"        "
-msgstr ""
-
 #: settings/serializers/auth/sso.py:12
 msgid "Enable SSO auth"
 msgstr "启用 SSO Token 认证"
@@ -2933,44 +2977,52 @@ msgstr "邮件的内容"
 msgid "Tips:When creating a user, send the content of the email"
 msgstr "提示: 创建用户时，发送设置密码邮件的内容"
 
-#: settings/serializers/email.py:69
-msgid "Signature"
-msgstr "署名"
-
 #: settings/serializers/email.py:70
 msgid "Tips: Email signature (eg:jumpserver)"
 msgstr "邮件署名 (如:jumpserver)"
 
-#: settings/serializers/other.py:9
+#: settings/serializers/other.py:7
 msgid "Email suffix"
 msgstr "邮件后缀"
 
-#: settings/serializers/other.py:10
+#: settings/serializers/other.py:8
 msgid ""
 "This is used by default if no email is returned during SSO authentication"
 msgstr "SSO认证时，如果没有返回邮件地址，将使用该后缀"
 
-#: settings/serializers/other.py:12
+#: settings/serializers/other.py:10
 msgid "Enable tickets"
 msgstr "启用工单系统"
 
-#: settings/serializers/other.py:15
+#: settings/serializers/other.py:13
 msgid "OTP issuer name"
 msgstr "OTP 扫描后的名称"
 
-#: settings/serializers/other.py:17
+#: settings/serializers/other.py:15
 msgid "OTP valid window"
 msgstr "OTP 延迟有效次数"
 
-#: settings/serializers/other.py:19
+#: settings/serializers/other.py:17
 msgid "Enable period task"
 msgstr "启用周期任务"
 
-#: settings/serializers/other.py:21
-msgid "Ansible windows default shell"
-msgstr "Ansible windows shell"
+#: settings/serializers/other.py:20
+msgid "CMD"
+msgstr ""
 
-#: settings/serializers/other.py:25
+#: settings/serializers/other.py:21
+msgid "PowerShell"
+msgstr ""
+
+#: settings/serializers/other.py:23
+msgid "Shell (Windows)"
+msgstr "Shell（Windows 资产）"
+
+#: settings/serializers/other.py:24
+msgid "The shell type used when Windows assets perform ansible tasks"
+msgstr "windows 资产执行 Ansible 任务时，使用的 Shell 类型。"
+
+#: settings/serializers/other.py:28
 msgid "Perm single to ungroup node"
 msgstr "直接授权资产放在未分组节点"
 
@@ -3138,6 +3190,10 @@ msgstr "会话分享"
 msgid "Enabled, Allows user active session to be shared with other users"
 msgstr "开启后允许用户分享已连接的资产会话给它人，协同工作"
 
+#: settings/serializers/security.py:116
+msgid "Enabled, please go to the user detail add approver"
+msgstr "启用后, 请在用户详情中添加审批人"
+
 #: settings/serializers/sms.py:7
 msgid "Label"
 msgstr "标签"
@@ -3486,7 +3542,7 @@ msgstr "数据库应用"
 msgid "Perms"
 msgstr "权限管理"
 
-#: templates/_nav.html:97 terminal/notifications.py:16
+#: templates/_nav.html:97 terminal/notifications.py:19
 msgid "Sessions"
 msgstr "会话管理"
 
@@ -3922,7 +3978,8 @@ msgstr "加入日期"
 msgid "Date left"
 msgstr "结束日期"
 
-#: terminal/models/sharing.py:91 xpack/plugins/change_auth_plan/models.py:274
+#: terminal/models/sharing.py:91
+#: xpack/plugins/change_auth_plan/models/base.py:178
 msgid "Finished"
 msgstr "结束"
 
@@ -3994,52 +4051,64 @@ msgstr "命令存储"
 msgid "Replay storage"
 msgstr "录像存储"
 
-#: terminal/notifications.py:50
+#: terminal/notifications.py:65
 msgid "Danger command alert"
 msgstr "危险命令告警"
 
-#: terminal/notifications.py:59
+#: terminal/notifications.py:78
 #, python-format
 msgid ""
 "\n"
-"                        Command: %(command)s\n"
-"                        <br>\n"
-"                        Asset: %(host_name)s (%(host_ip)s)\n"
-"                        <br>\n"
-"                        User: %(user)s\n"
-"                        <br>\n"
-"                        Level: %(risk_level)s\n"
-"                        <br>\n"
-"                        Session: <a href=\"%(session_detail_url)s\">session "
+"Command: %(command)s\n"
+"Asset: %(hostname)s (%(host_ip)s)\n"
+"User: %(user)s\n"
+"Level: %(risk_level)s\n"
+"Session: %(session_detail_url)s?oid=%(oid)s\n"
+"        "
+msgstr ""
+"\n"
+"命令: %(command)s\n"
+"资产: %(hostname)s (%(host_ip)s)\n"
+"用户: %(user)s\n"
+"等级: %(risk_level)s\n"
+"会话: %(session_detail_url)s?oid=%(oid)s\n"
+"        "
+
+#: terminal/notifications.py:106
+#, python-format
+msgid ""
+"\n"
+"            Command: %(command)s\n"
+"            <br>\n"
+"            Asset: %(hostname)s (%(host_ip)s)\n"
+"            <br>\n"
+"            User: %(user)s\n"
+"            <br>\n"
+"            Level: %(risk_level)s\n"
+"            <br>\n"
+"            Session: <a href=\"%(session_detail_url)s?oid=%(oid)s\">session "
 "detail</a>\n"
-"                        <br>\n"
-"                        "
+"            <br>\n"
+"        "
 msgstr ""
 "\n"
 "        命令: %(command)s\n"
 "        <br>\n"
-"        资产: %(host_name)s (%(host_ip)s)\n"
+"        资产: %(hostname)s (%(host_ip)s)\n"
 "        <br>\n"
 "        用户: %(user)s\n"
 "        <br>\n"
 "        等级: %(risk_level)s\n"
 "        <br>\n"
-"        会话: <a href=\"%(session_detail_url)s\">会话详情</a>\n"
+"        会话: <a href=\"%(session_detail_url)s?oid=%(oid)s\">会话详情</a>\n"
 "        <br>\n"
 "        "
 
-#: terminal/notifications.py:99
-#, python-format
-msgid ""
-"Insecure Command Alert: [%(name)s->%(login_from)s@%(remote_addr)s] $"
-"%(command)s"
-msgstr "危险命令告警: [%(name)s->%(login_from)s@%(remote_addr)s] $%(command)s"
-
-#: terminal/notifications.py:117
+#: terminal/notifications.py:135
 msgid "Batch danger command alert"
 msgstr "批量危险命令告警"
 
-#: terminal/notifications.py:128
+#: terminal/notifications.py:146
 #, python-format
 msgid ""
 "\n"
@@ -4064,16 +4133,26 @@ msgstr ""
 "        <br>\n"
 "        等级: %(risk_level)s\n"
 "        <br>\n"
-"\n"
+"<br>\n"
 "        ----------------- 命令 ---------------- <br>\n"
 "        %(command)s <br>\n"
 "        ----------------- 命令 ---------------- <br>\n"
+"<br>\n"
 "        "
 
-#: terminal/notifications.py:150
+#: terminal/notifications.py:173
 #, python-format
-msgid "Insecure Web Command Execution Alert: [%(name)s]"
-msgstr "批量危险命令告警: [%(name)s]"
+msgid ""
+"\n"
+"Assets: %(assets)s\n"
+"User: %(user)s\n"
+"Level: %(risk_level)s\n"
+"\n"
+"Commands 👇 ------------\n"
+"%(command)s\n"
+"------------------------\n"
+"                            "
+msgstr ""
 
 #: terminal/serializers/session.py:31
 msgid "User ID"
@@ -4120,7 +4199,7 @@ msgstr "Secret key"
 msgid "Endpoint"
 msgstr "端点"
 
-#: terminal/serializers/storage.py:66 xpack/plugins/cloud/models.py:209
+#: terminal/serializers/storage.py:66 xpack/plugins/cloud/models.py:214
 msgid "Region"
 msgstr "地域"
 
@@ -4363,28 +4442,28 @@ msgstr "用户显示名称"
 msgid "Body"
 msgstr "内容"
 
-#: tickets/models/flow.py:19 tickets/models/flow.py:55
+#: tickets/models/flow.py:20 tickets/models/flow.py:56
 #: tickets/models/ticket.py:25
 msgid "Approve level"
 msgstr "审批级别"
 
-#: tickets/models/flow.py:24 tickets/serializers/ticket/ticket.py:140
+#: tickets/models/flow.py:25 tickets/serializers/ticket/ticket.py:140
 msgid "Approve strategy"
 msgstr "审批策略"
 
-#: tickets/models/flow.py:29 tickets/serializers/ticket/ticket.py:141
+#: tickets/models/flow.py:30 tickets/serializers/ticket/ticket.py:141
 msgid "Assignees"
 msgstr "受理人"
 
-#: tickets/models/flow.py:33
+#: tickets/models/flow.py:34
 msgid "Assignees display"
 msgstr "受理人名称"
 
-#: tickets/models/flow.py:37
+#: tickets/models/flow.py:38
 msgid "Ticket flow approval rule"
 msgstr "工单批准信息"
 
-#: tickets/models/flow.py:60
+#: tickets/models/flow.py:61
 msgid "Ticket flow"
 msgstr "工单流程"
 
@@ -4420,6 +4499,18 @@ msgstr "流程"
 msgid "TicketFlow"
 msgstr "工单流程"
 
+#: tickets/notifications.py:44 tickets/notifications.py:56
+msgid "click here to review"
+msgstr "点击查看"
+
+#: tickets/notifications.py:74
+msgid "Your has a new ticket, applicant - {}"
+msgstr "你有一个新的工单, 申请人 - {}"
+
+#: tickets/notifications.py:87
+msgid "Your ticket has been processed, processor - {}"
+msgstr "你的工单已被处理, 处理人 - {}"
+
 #: tickets/serializers/ticket/meta/ticket_type/apply_application.py:16
 #: tickets/serializers/ticket/meta/ticket_type/apply_asset.py:16
 msgid "Apply name"
@@ -4523,30 +4614,14 @@ msgstr "提交数据中的类型 (`{}`) 与请求URL地址中的类型 (`{}`) 
 msgid "The ticket flow `{}` does not exist"
 msgstr "工单流程 `{}` 不存在"
 
-#: tickets/serializers/ticket/ticket.py:182
+#: tickets/serializers/ticket/ticket.py:162
+msgid "Please select the Assignees"
+msgstr "请选择受理人"
+
+#: tickets/serializers/ticket/ticket.py:188
 msgid "The current organization type already exists"
 msgstr "当前组织已存在该类型"
 
-#: tickets/utils.py:37
-msgid "New Ticket - {} ({})"
-msgstr "新工单 - {} ({})"
-
-#: tickets/utils.py:39
-msgid "Your has a new ticket, applicant - {}"
-msgstr "你有一个新的工单, 申请人 - {}"
-
-#: tickets/utils.py:41 tickets/utils.py:60
-msgid "click here to review"
-msgstr "点击查看"
-
-#: tickets/utils.py:56
-msgid "Ticket has processed - {} ({})"
-msgstr "工单已处理 - {} ({})"
-
-#: tickets/utils.py:58
-msgid "Your ticket has been processed, processor - {}"
-msgstr "你的工单已被处理, 处理人 - {}"
-
 #: users/api/user.py:208
 msgid "Could not reset self otp, use profile reset instead"
 msgstr "不能在该页面重置多因子认证, 请去个人信息页面重置"
@@ -4699,13 +4774,14 @@ msgstr "管理员"
 msgid "Administrator is the super user of system"
 msgstr "Administrator是初始的超级管理员"
 
-#: users/notifications.py:43 users/notifications.py:76
+#: users/notifications.py:12 users/notifications.py:45
 #: users/templates/users/reset_password.html:5
 #: users/templates/users/reset_password.html:6
 msgid "Reset password"
 msgstr "重置密码"
 
-#: users/notifications.py:44
+#: users/notifications.py:13
+#, python-format
 msgid ""
 "\n"
 "Hello %(name)s:\n"
@@ -4728,8 +4804,8 @@ msgid ""
 msgstr ""
 "\n"
 "您好 %(name)s:\n"
-"请点击下面链接重置密码， 如果不是您申请的，请关注账号安全\n "
-"\n"
+"请点击下面链接重置密码， 如果不是您申请的，请关注账号安全\n"
+" \n"
 "请点击这里设置密码 👇\n"
 "%(rest_password_url)s?token=%(rest_password_token)s\n"
 "\n"
@@ -4744,7 +4820,8 @@ msgstr ""
 "%(login_url)s\n"
 "\n"
 
-#: users/notifications.py:77
+#: users/notifications.py:46
+#, python-format
 msgid ""
 "\n"
 "            Hello %(name)s:\n"
@@ -4787,12 +4864,13 @@ msgstr ""
 "    <br>\n"
 "    "
 
-#: users/notifications.py:116 users/notifications.py:150
+#: users/notifications.py:85 users/notifications.py:119
 #: users/views/profile/reset.py:127
 msgid "Reset password success"
 msgstr "重置密码成功"
 
-#: users/notifications.py:117
+#: users/notifications.py:86
+#, python-format
 msgid ""
 "\n"
 "        \n"
@@ -4824,8 +4902,7 @@ msgstr ""
 "\n"
 "你的 JumpServer 密码刚刚已经成功更新。\n"
 "\n"
-"如果这次密码更新不是由你发起的，那么你的账号可能存在安全问题。 "
-"\n"
+"如果这次密码更新不是由你发起的，那么你的账号可能存在安全问题。 \n"
 "建议你立刻登录 JumpServer 更改密码。 \n"
 "\n"
 "如果你有任何疑问，可以联系管理员。\n"
@@ -4841,7 +4918,8 @@ msgstr ""
 "        \n"
 "        "
 
-#: users/notifications.py:151
+#: users/notifications.py:120
+#, python-format
 msgid ""
 "\n"
 "        \n"
@@ -4903,11 +4981,12 @@ msgstr ""
 "    \n"
 "    "
 
-#: users/notifications.py:194 users/notifications.py:230
+#: users/notifications.py:163 users/notifications.py:199
 msgid "Security notice"
 msgstr "安全通知"
 
-#: users/notifications.py:195
+#: users/notifications.py:164
+#, python-format
 msgid ""
 "\n"
 "Hello %(name)s:\n"
@@ -4939,10 +5018,8 @@ msgstr ""
 "为了您的账号安全，请点击下面的链接及时更新密码 \n"
 "\n"
 "请点击这里更新密码 👇\n"
-"%(update_password_url)s"
-"\n"
-"如果您的密码已经过期，请点击 👇 申请一份重置密码邮件。 "
-"\n"
+"%(update_password_url)s\n"
+"如果您的密码已经过期，请点击 👇 申请一份重置密码邮件。 \n"
 "%(forget_password_url)s?email=%(email)s\n"
 "\n"
 "-------------------\n"
@@ -4952,7 +5029,8 @@ msgstr ""
 "\n"
 "        "
 
-#: users/notifications.py:231
+#: users/notifications.py:200
+#, python-format
 msgid ""
 "\n"
 "        Hello %(name)s:\n"
@@ -5000,11 +5078,12 @@ msgstr ""
 "    <br>\n"
 "    "
 
-#: users/notifications.py:268 users/notifications.py:287
+#: users/notifications.py:237 users/notifications.py:256
 msgid "Expiration notice"
 msgstr "过期通知"
 
-#: users/notifications.py:269
+#: users/notifications.py:238
+#, python-format
 msgid ""
 "\n"
 "Hello %(name)s:\n"
@@ -5021,11 +5100,11 @@ msgstr ""
 "\n"
 "您的账户会在 %(date_expired)s 过期,\n"
 "\n"
-"为了不影响您正常工作，请联系管理员确认。"
-"\n"
+"为了不影响您正常工作，请联系管理员确认。\n"
 "           "
 
-#: users/notifications.py:288
+#: users/notifications.py:257
+#, python-format
 msgid ""
 "\n"
 "           Hello %(name)s:\n"
@@ -5046,11 +5125,12 @@ msgstr ""
 "       <br>\n"
 "       "
 
-#: users/notifications.py:308 users/notifications.py:329
+#: users/notifications.py:277 users/notifications.py:298
 msgid "SSH Key Reset"
 msgstr "重置SSH密钥"
 
-#: users/notifications.py:309
+#: users/notifications.py:278
+#, python-format
 msgid ""
 "\n"
 "Hello %(name)s:\n"
@@ -5074,7 +5154,8 @@ msgstr ""
 "\n"
 "        "
 
-#: users/notifications.py:330
+#: users/notifications.py:299
+#, python-format
 msgid ""
 "\n"
 "        Hello %(name)s:\n"
@@ -5098,11 +5179,12 @@ msgstr ""
 "    <br>\n"
 "    "
 
-#: users/notifications.py:352 users/notifications.py:372
+#: users/notifications.py:321 users/notifications.py:341
 msgid "MFA Reset"
 msgstr "重置 MFA"
 
-#: users/notifications.py:353
+#: users/notifications.py:322
+#, python-format
 msgid ""
 "\n"
 "Hello %(name)s:\n"
@@ -5126,7 +5208,8 @@ msgstr ""
 "\n"
 "        "
 
-#: users/notifications.py:373
+#: users/notifications.py:342
+#, python-format
 msgid ""
 "\n"
 "        Hello %(name)s:\n"
@@ -5170,8 +5253,9 @@ msgstr "两次密码不一致"
 msgid "Is first login"
 msgstr "首次登录"
 
-#: users/serializers/user.py:22 xpack/plugins/change_auth_plan/models.py:61
-#: xpack/plugins/change_auth_plan/serializers.py:30
+#: users/serializers/user.py:22
+#: xpack/plugins/change_auth_plan/models/base.py:32
+#: xpack/plugins/change_auth_plan/serializers/base.py:24
 msgid "Password strategy"
 msgstr "密码策略"
 
@@ -5239,7 +5323,7 @@ msgstr "是否绑定了飞书"
 msgid "Role limit to {}"
 msgstr "角色只能为 {}"
 
-#: users/serializers/user.py:221
+#: users/serializers/user.py:231
 msgid "name not unique"
 msgstr "名称重复"
 
@@ -5560,90 +5644,147 @@ msgstr "* 新密码不能是最近 {} 次的密码"
 msgid "Reset password success, return to login page"
 msgstr "重置密码成功，返回到登录页面"
 
+#: xpack/plugins/change_auth_plan/api/app.py:112
+#: xpack/plugins/change_auth_plan/api/asset.py:100
+msgid "The parameter 'action' must be [{}]"
+msgstr "参数 'action' 必须是 [{}]"
+
 #: xpack/plugins/change_auth_plan/meta.py:9
-#: xpack/plugins/change_auth_plan/models.py:89
-#: xpack/plugins/change_auth_plan/models.py:184
+#: xpack/plugins/change_auth_plan/models/asset.py:63
+#: xpack/plugins/change_auth_plan/models/asset.py:119
 msgid "Change auth plan"
 msgstr "改密计划"
 
-#: xpack/plugins/change_auth_plan/models.py:41
-msgid "Custom password"
-msgstr "自定义密码"
+#: xpack/plugins/change_auth_plan/models/app.py:41
+#: xpack/plugins/change_auth_plan/models/app.py:90
+msgid "Application change auth plan"
+msgstr "应用改密计划执行"
 
-#: xpack/plugins/change_auth_plan/models.py:42
-msgid "All assets use the same random password"
-msgstr "使用相同的随机密码"
+#: xpack/plugins/change_auth_plan/models/app.py:94
+#: xpack/plugins/change_auth_plan/models/app.py:146
+msgid "Application change auth plan execution"
+msgstr "应用改密计划执行"
 
-#: xpack/plugins/change_auth_plan/models.py:43
-msgid "All assets use different random password"
-msgstr "使用不同的随机密码"
+#: xpack/plugins/change_auth_plan/models/app.py:139
+msgid "App"
+msgstr "应用"
 
-#: xpack/plugins/change_auth_plan/models.py:65
-msgid "Password rules"
-msgstr "密码规则"
+#: xpack/plugins/change_auth_plan/models/app.py:151
+msgid "Application change auth plan task"
+msgstr "用用改密计划任务"
 
-#: xpack/plugins/change_auth_plan/models.py:187
-msgid "Change auth plan snapshot"
-msgstr "改密计划快照"
+#: xpack/plugins/change_auth_plan/models/asset.py:30
+msgid "Append SSH KEY"
+msgstr "追加"
 
-#: xpack/plugins/change_auth_plan/models.py:202
-#: xpack/plugins/change_auth_plan/models.py:296
+#: xpack/plugins/change_auth_plan/models/asset.py:31
+msgid "Empty and append SSH KEY"
+msgstr "清空所有并添加"
+
+#: xpack/plugins/change_auth_plan/models/asset.py:32
+msgid "Empty pre add and append SSH KEY"
+msgstr "清空上次并添加"
+
+#: xpack/plugins/change_auth_plan/models/asset.py:50
+#: xpack/plugins/change_auth_plan/serializers/asset.py:34
+msgid "SSH Key strategy"
+msgstr "SSH 密钥策略"
+
+#: xpack/plugins/change_auth_plan/models/asset.py:130
+#: xpack/plugins/change_auth_plan/models/asset.py:206
 msgid "Change auth plan execution"
 msgstr "改密计划执行"
 
-#: xpack/plugins/change_auth_plan/models.py:269
-msgid "Ready"
-msgstr "准备"
-
-#: xpack/plugins/change_auth_plan/models.py:270
-msgid "Preflight check"
-msgstr "改密前的校验"
-
-#: xpack/plugins/change_auth_plan/models.py:271
-msgid "Change auth"
-msgstr "执行改密"
-
-#: xpack/plugins/change_auth_plan/models.py:272
-msgid "Verify auth"
-msgstr "验证密码/密钥"
-
-#: xpack/plugins/change_auth_plan/models.py:273
-msgid "Keep auth"
-msgstr "保存密码/密钥"
-
-#: xpack/plugins/change_auth_plan/models.py:300
-msgid "Step"
-msgstr "步骤"
-
-#: xpack/plugins/change_auth_plan/models.py:317
+#: xpack/plugins/change_auth_plan/models/asset.py:213
 msgid "Change auth plan task"
 msgstr "改密计划任务"
 
-#: xpack/plugins/change_auth_plan/serializers.py:56
+#: xpack/plugins/change_auth_plan/models/base.py:24
+msgid "Custom password"
+msgstr "自定义密码"
+
+#: xpack/plugins/change_auth_plan/models/base.py:25
+msgid "All assets use the same random password"
+msgstr "使用相同的随机密码"
+
+#: xpack/plugins/change_auth_plan/models/base.py:26
+msgid "All assets use different random password"
+msgstr "使用不同的随机密码"
+
+#: xpack/plugins/change_auth_plan/models/base.py:36
+msgid "Password rules"
+msgstr "密码规则"
+
+#: xpack/plugins/change_auth_plan/models/base.py:100
+msgid "Manual trigger"
+msgstr "手动触发"
+
+#: xpack/plugins/change_auth_plan/models/base.py:101
+msgid "Timing trigger"
+msgstr "定时触发"
+
+#: xpack/plugins/change_auth_plan/models/base.py:111
+msgid "Change auth plan snapshot"
+msgstr "改密计划快照"
+
+#: xpack/plugins/change_auth_plan/models/base.py:118
+#: xpack/plugins/change_auth_plan/serializers/base.py:70
+msgid "Trigger mode"
+msgstr "触发模式"
+
+#: xpack/plugins/change_auth_plan/models/base.py:173
+msgid "Ready"
+msgstr "准备"
+
+#: xpack/plugins/change_auth_plan/models/base.py:174
+msgid "Preflight check"
+msgstr "改密前的校验"
+
+#: xpack/plugins/change_auth_plan/models/base.py:175
+msgid "Change auth"
+msgstr "执行改密"
+
+#: xpack/plugins/change_auth_plan/models/base.py:176
+msgid "Verify auth"
+msgstr "验证密码/密钥"
+
+#: xpack/plugins/change_auth_plan/models/base.py:177
+msgid "Keep auth"
+msgstr "保存密码/密钥"
+
+#: xpack/plugins/change_auth_plan/models/base.py:185
+msgid "Step"
+msgstr "步骤"
+
+#: xpack/plugins/change_auth_plan/serializers/asset.py:31
+msgid "Change Password"
+msgstr "更改密码"
+
+#: xpack/plugins/change_auth_plan/serializers/asset.py:32
+msgid "Change SSH Key"
+msgstr "修改 SSH Key"
+
+#: xpack/plugins/change_auth_plan/serializers/base.py:43
 msgid "Run times"
 msgstr "执行次数"
 
-#: xpack/plugins/change_auth_plan/serializers.py:72
-msgid "* Please enter custom password"
-msgstr "* 请输入自定义密码"
-
-#: xpack/plugins/change_auth_plan/serializers.py:82
+#: xpack/plugins/change_auth_plan/serializers/base.py:54
 msgid "* Please enter the correct password length"
 msgstr "* 请输入正确的密码长度"
 
-#: xpack/plugins/change_auth_plan/serializers.py:85
+#: xpack/plugins/change_auth_plan/serializers/base.py:57
 msgid "* Password length range 6-30 bits"
 msgstr "* 密码长度范围 6-30 位"
 
-#: xpack/plugins/change_auth_plan/utils.py:442
+#: xpack/plugins/change_auth_plan/task_handlers/base/handler.py:248
 msgid "Invalid/incorrect password"
 msgstr "无效/错误 密码"
 
-#: xpack/plugins/change_auth_plan/utils.py:444
+#: xpack/plugins/change_auth_plan/task_handlers/base/handler.py:250
 msgid "Failed to connect to the host"
 msgstr "连接主机失败"
 
-#: xpack/plugins/change_auth_plan/utils.py:446
+#: xpack/plugins/change_auth_plan/task_handlers/base/handler.py:252
 msgid "Data could not be sent to remote"
 msgstr "无法将数据发送到远程"
 
@@ -5699,31 +5840,35 @@ msgstr "华为私有云"
 msgid "Qingyun Private Cloud"
 msgstr "青云私有云"
 
-#: xpack/plugins/cloud/const.py:22
+#: xpack/plugins/cloud/const.py:19
+msgid "Google Cloud Platform"
+msgstr "谷歌云"
+
+#: xpack/plugins/cloud/const.py:23
 msgid "Instance name"
 msgstr "实例名称"
 
-#: xpack/plugins/cloud/const.py:23
+#: xpack/plugins/cloud/const.py:24
 msgid "Instance name and Partial IP"
 msgstr "实例名称和部分IP"
 
-#: xpack/plugins/cloud/const.py:28
+#: xpack/plugins/cloud/const.py:29
 msgid "Succeed"
 msgstr "成功"
 
-#: xpack/plugins/cloud/const.py:32
+#: xpack/plugins/cloud/const.py:33
 msgid "Unsync"
 msgstr "未同步"
 
-#: xpack/plugins/cloud/const.py:33
+#: xpack/plugins/cloud/const.py:34
 msgid "New Sync"
 msgstr "新同步"
 
-#: xpack/plugins/cloud/const.py:34
+#: xpack/plugins/cloud/const.py:35
 msgid "Synced"
 msgstr "已同步"
 
-#: xpack/plugins/cloud/const.py:35
+#: xpack/plugins/cloud/const.py:36
 msgid "Released"
 msgstr "已释放"
 
@@ -5739,7 +5884,7 @@ msgstr "云服务商"
 msgid "Cloud account"
 msgstr "云账号"
 
-#: xpack/plugins/cloud/models.py:85 xpack/plugins/cloud/serializers.py:179
+#: xpack/plugins/cloud/models.py:85 xpack/plugins/cloud/serializers/task.py:37
 msgid "Regions"
 msgstr "地域"
 
@@ -5747,35 +5892,43 @@ msgstr "地域"
 msgid "Hostname strategy"
 msgstr "主机名策略"
 
-#: xpack/plugins/cloud/models.py:102 xpack/plugins/cloud/serializers.py:186
+#: xpack/plugins/cloud/models.py:97 xpack/plugins/cloud/serializers/task.py:66
+msgid "Unix admin user"
+msgstr "Unix 管理员"
+
+#: xpack/plugins/cloud/models.py:101 xpack/plugins/cloud/serializers/task.py:67
+msgid "Windows admin user"
+msgstr "Windows 管理员"
+
+#: xpack/plugins/cloud/models.py:107 xpack/plugins/cloud/serializers/task.py:45
 msgid "IP network segment group"
 msgstr "IP网段组"
 
-#: xpack/plugins/cloud/models.py:105 xpack/plugins/cloud/serializers.py:208
+#: xpack/plugins/cloud/models.py:110 xpack/plugins/cloud/serializers/task.py:70
 msgid "Always update"
 msgstr "总是更新"
 
-#: xpack/plugins/cloud/models.py:111
+#: xpack/plugins/cloud/models.py:116
 msgid "Date last sync"
 msgstr "最后同步日期"
 
-#: xpack/plugins/cloud/models.py:122 xpack/plugins/cloud/models.py:163
+#: xpack/plugins/cloud/models.py:127 xpack/plugins/cloud/models.py:168
 msgid "Sync instance task"
 msgstr "同步实例任务"
 
-#: xpack/plugins/cloud/models.py:174 xpack/plugins/cloud/models.py:219
+#: xpack/plugins/cloud/models.py:179 xpack/plugins/cloud/models.py:224
 msgid "Date sync"
 msgstr "同步日期"
 
-#: xpack/plugins/cloud/models.py:199
+#: xpack/plugins/cloud/models.py:204
 msgid "Sync task"
 msgstr "同步任务"
 
-#: xpack/plugins/cloud/models.py:203
+#: xpack/plugins/cloud/models.py:208
 msgid "Sync instance task history"
 msgstr "同步实例任务历史"
 
-#: xpack/plugins/cloud/models.py:206
+#: xpack/plugins/cloud/models.py:211
 msgid "Instance"
 msgstr "实例"
 
@@ -5919,35 +6072,40 @@ msgstr "西南-贵阳1"
 msgid "EU-Paris"
 msgstr "欧洲-巴黎"
 
-#: xpack/plugins/cloud/serializers.py:21
+#: xpack/plugins/cloud/serializers/account_attrs.py:13
 msgid "AccessKey ID"
 msgstr ""
 
-#: xpack/plugins/cloud/serializers.py:24
+#: xpack/plugins/cloud/serializers/account_attrs.py:16
 msgid "AccessKey Secret"
 msgstr ""
 
-#: xpack/plugins/cloud/serializers.py:30
+#: xpack/plugins/cloud/serializers/account_attrs.py:23
 msgid "Client ID"
 msgstr "客户端 ID"
 
-#: xpack/plugins/cloud/serializers.py:36
+#: xpack/plugins/cloud/serializers/account_attrs.py:29
 msgid "Tenant ID"
 msgstr "租户 ID"
 
-#: xpack/plugins/cloud/serializers.py:39
+#: xpack/plugins/cloud/serializers/account_attrs.py:32
 msgid "Subscription ID"
 msgstr "订阅 ID"
 
-#: xpack/plugins/cloud/serializers.py:51
-msgid "This field is required"
-msgstr "该字段是必填项。"
-
-#: xpack/plugins/cloud/serializers.py:85 xpack/plugins/cloud/serializers.py:89
+#: xpack/plugins/cloud/serializers/account_attrs.py:81
+#: xpack/plugins/cloud/serializers/account_attrs.py:86
 msgid "API Endpoint"
 msgstr "API 端点"
 
-#: xpack/plugins/cloud/serializers.py:171
+#: xpack/plugins/cloud/serializers/account_attrs.py:92
+msgid "Service account key"
+msgstr "账户密钥"
+
+#: xpack/plugins/cloud/serializers/account_attrs.py:93
+msgid "The file is in JSON format"
+msgstr "JSON 格式的文件"
+
+#: xpack/plugins/cloud/serializers/task.py:29
 msgid ""
 "The IP address that is first matched to will be used as the IP of the "
 "created asset. <br>The default * indicates a random match. <br>Format for "
@@ -5956,11 +6114,11 @@ msgstr ""
 "第一个匹配到的 IP 地址将被用作创建的资产的 IP。<br> 默认值 * 表示随机匹配。"
 "<br> 格式为以逗号分隔的字符串，例如:192.168.1.0/24,10.1.1.1-10.1.1.20"
 
-#: xpack/plugins/cloud/serializers.py:177
+#: xpack/plugins/cloud/serializers/task.py:35
 msgid "History count"
 msgstr "执行次数"
 
-#: xpack/plugins/cloud/serializers.py:178
+#: xpack/plugins/cloud/serializers/task.py:36
 msgid "Instance count"
 msgstr "实例个数"
 
diff --git a/apps/notifications/backends/__init__.py b/apps/notifications/backends/__init__.py
index a991b9567..2e95bd437 100644
--- a/apps/notifications/backends/__init__.py
+++ b/apps/notifications/backends/__init__.py
@@ -12,7 +12,7 @@ class BACKEND(models.TextChoices):
     DINGTALK = 'dingtalk', _('DingTalk')
     SITE_MSG = 'site_msg', _('Site message')
     FEISHU = 'feishu', _('FeiShu')
-    SMS = 'sms', _('SMS')
+    # SMS = 'sms', _('SMS')
 
     @property
     def client(self):
diff --git a/apps/notifications/notifications.py b/apps/notifications/notifications.py
index 1141c104f..ab2f25492 100644
--- a/apps/notifications/notifications.py
+++ b/apps/notifications/notifications.py
@@ -1,10 +1,12 @@
 from typing import Iterable
 import traceback
 from itertools import chain
-from collections import defaultdict
+import time
 
 from celery import shared_task
+from django.utils.translation import gettext_lazy as _
 
+from common.utils.timezone import now
 from common.utils import lazyproperty
 from users.models import User
 from notifications.backends import BACKEND
@@ -90,32 +92,58 @@ class Message(metaclass=MessageType):
             except:
                 traceback.print_exc()
 
+    def send_test_msg(self):
+        from users.models import User
+        users = User.objects.filter(username='admin')
+        self.send_msg(users, [])
+
     def get_common_msg(self) -> dict:
         raise NotImplementedError
 
+    def get_text_msg(self) -> dict:
+        return self.common_msg
+
+    def get_html_msg(self) -> dict:
+        return self.common_msg
+
     @lazyproperty
     def common_msg(self) -> dict:
         return self.get_common_msg()
 
+    @lazyproperty
+    def text_msg(self) -> dict:
+        return self.get_text_msg()
+
+    @lazyproperty
+    def html_msg(self) -> dict:
+        return self.get_html_msg()
+
     # --------------------------------------------------------------
     # 支持不同发送消息的方式定义自己的消息内容，比如有些支持 html 标签
     def get_dingtalk_msg(self) -> dict:
-        return self.common_msg
+        # 钉钉相同的消息一天只能发一次，所以给所有消息添加基于时间的序号，使他们不相同
+        message = self.text_msg['message']
+        suffix = _('\nTime: {}').format(now())
+
+        return {
+            'subject': self.text_msg['subject'],
+            'message': message + suffix
+        }
 
     def get_wecom_msg(self) -> dict:
-        return self.common_msg
+        return self.text_msg
 
     def get_feishu_msg(self) -> dict:
-        return self.common_msg
+        return self.text_msg
 
     def get_email_msg(self) -> dict:
-        return self.common_msg
+        return self.html_msg
 
     def get_site_msg_msg(self) -> dict:
-        return self.common_msg
+        return self.html_msg
 
     def get_sms_msg(self) -> dict:
-        raise NotImplementedError
+        return self.text_msg
     # --------------------------------------------------------------
 
 
@@ -136,6 +164,7 @@ class SystemMessage(Message):
 
         self.send_msg(users, receive_backends)
 
+
     @classmethod
     def post_insert_to_db(cls, subscription: SystemMsgSubscription):
         pass
diff --git a/apps/perms/api/application/application_permission.py b/apps/perms/api/application/application_permission.py
index a97665d53..9c3eb18b4 100644
--- a/apps/perms/api/application/application_permission.py
+++ b/apps/perms/api/application/application_permission.py
@@ -16,6 +16,7 @@ class ApplicationPermissionViewSet(BasePermissionViewSet):
         'name': ['exact'],
         'category': ['exact'],
         'type': ['exact', 'in'],
+        'from_ticket': ['exact']
     }
     search_fields = ['name', 'category', 'type']
     custom_filter_fields = BasePermissionViewSet.custom_filter_fields + [
diff --git a/apps/perms/filters.py b/apps/perms/filters.py
index adf4c8404..f56927436 100644
--- a/apps/perms/filters.py
+++ b/apps/perms/filters.py
@@ -21,8 +21,8 @@ class PermissionBaseFilter(BaseFilterSet):
 
     class Meta:
         fields = (
-            'user_id', 'username', 'system_user_id', 'system_user', 'user_group_id',
-            'user_group', 'name', 'all', 'is_valid',
+            'user_id', 'username', 'system_user_id', 'system_user',
+            'user_group_id', 'user_group', 'name', 'all', 'is_valid',
         )
 
     @property
@@ -118,7 +118,7 @@ class AssetPermissionFilter(PermissionBaseFilter):
         fields = (
             'user_id', 'username', 'system_user_id', 'system_user', 'user_group_id',
             'user_group', 'node_id', 'node', 'asset_id', 'hostname', 'ip', 'name',
-            'all', 'asset_id', 'is_valid', 'is_effective',
+            'all', 'asset_id', 'is_valid', 'is_effective', 'from_ticket'
         )
 
     @property
diff --git a/apps/perms/migrations/0020_auto_20210910_1103.py b/apps/perms/migrations/0020_auto_20210910_1103.py
new file mode 100644
index 000000000..0d01345f5
--- /dev/null
+++ b/apps/perms/migrations/0020_auto_20210910_1103.py
@@ -0,0 +1,24 @@
+# Generated by Django 3.1.12 on 2021-09-10 03:03
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('assets', '0076_delete_assetuser'),
+        ('perms', '0019_auto_20210906_1044'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='assetpermission',
+            name='system_users',
+            field=models.ManyToManyField(blank=True, related_name='granted_by_permissions', to='assets.SystemUser', verbose_name='System user'),
+        ),
+        migrations.AlterField(
+            model_name='applicationpermission',
+            name='system_users',
+            field=models.ManyToManyField(blank=True, related_name='granted_by_application_permissions', to='assets.SystemUser', verbose_name='System user'),
+        ),
+    ]
diff --git a/apps/perms/models/application_permission.py b/apps/perms/models/application_permission.py
index a405e667c..40ac61ed8 100644
--- a/apps/perms/models/application_permission.py
+++ b/apps/perms/models/application_permission.py
@@ -27,7 +27,8 @@ class ApplicationPermission(BasePermission):
         verbose_name=_("Application")
     )
     system_users = models.ManyToManyField(
-        'assets.SystemUser', related_name='granted_by_application_permissions',
+        'assets.SystemUser',
+        related_name='granted_by_application_permissions', blank=True,
         verbose_name=_("System user")
     )
 
diff --git a/apps/perms/models/asset_permission.py b/apps/perms/models/asset_permission.py
index f763bee10..78e6b9b5b 100644
--- a/apps/perms/models/asset_permission.py
+++ b/apps/perms/models/asset_permission.py
@@ -98,7 +98,7 @@ class Action:
 class AssetPermission(BasePermission):
     assets = models.ManyToManyField('assets.Asset', related_name='granted_by_permissions', blank=True, verbose_name=_("Asset"))
     nodes = models.ManyToManyField('assets.Node', related_name='granted_by_permissions', blank=True, verbose_name=_("Nodes"))
-    system_users = models.ManyToManyField('assets.SystemUser', related_name='granted_by_permissions', verbose_name=_("System user"))
+    system_users = models.ManyToManyField('assets.SystemUser', related_name='granted_by_permissions', blank=True, verbose_name=_("System user"))
     actions = models.IntegerField(choices=Action.DB_CHOICES, default=Action.ALL, verbose_name=_("Actions"))
 
     class Meta:
diff --git a/apps/perms/utils/asset/user_permission.py b/apps/perms/utils/asset/user_permission.py
index b91039dcc..980a0e101 100644
--- a/apps/perms/utils/asset/user_permission.py
+++ b/apps/perms/utils/asset/user_permission.py
@@ -549,7 +549,7 @@ class UserGrantedNodesQueryUtils(UserGrantedUtilsBase):
             return self.get_top_level_nodes()
 
         nodes = PermNode.objects.none()
-        if key == PermNode.FAVORITE_NODE_KEY:
+        if key in [PermNode.FAVORITE_NODE_KEY, PermNode.UNGROUPED_NODE_KEY]:
             return nodes
 
         node = PermNode.objects.get(key=key)
diff --git a/apps/settings/api/alibaba_sms.py b/apps/settings/api/alibaba_sms.py
index c7f42f110..32460778e 100644
--- a/apps/settings/api/alibaba_sms.py
+++ b/apps/settings/api/alibaba_sms.py
@@ -4,7 +4,6 @@ from rest_framework.exceptions import APIException
 from rest_framework import status
 from django.utils.translation import gettext_lazy as _
 
-from common.message.backends.sms import SMS_MESSAGE
 from common.message.backends.sms.alibaba import AlibabaSMS
 from settings.models import Setting
 from common.permissions import IsSuperUser
@@ -23,7 +22,8 @@ class AlibabaSMSTestingAPI(GenericAPIView):
 
         alibaba_access_key_id = serializer.validated_data['ALIBABA_ACCESS_KEY_ID']
         alibaba_access_key_secret = serializer.validated_data.get('ALIBABA_ACCESS_KEY_SECRET')
-        alibaba_sms_sign_and_tmpl = serializer.validated_data['ALIBABA_SMS_SIGN_AND_TEMPLATES']
+        alibaba_verify_sign_name = serializer.validated_data['ALIBABA_VERIFY_SIGN_NAME']
+        alibaba_verify_template_code = serializer.validated_data['ALIBABA_VERIFY_TEMPLATE_CODE']
         test_phone = serializer.validated_data.get('SMS_TEST_PHONE')
 
         if not test_phone:
@@ -41,12 +41,11 @@ class AlibabaSMSTestingAPI(GenericAPIView):
                 access_key_id=alibaba_access_key_id,
                 access_key_secret=alibaba_access_key_secret
             )
-            sign, tmpl = SMS_MESSAGE.VERIFICATION_CODE.get_sign_and_tmpl(alibaba_sms_sign_and_tmpl)
 
             client.send_sms(
                 phone_numbers=[test_phone],
-                sign_name=sign,
-                template_code=tmpl,
+                sign_name=alibaba_verify_sign_name,
+                template_code=alibaba_verify_template_code,
                 template_param={'code': 'test'}
             )
             return Response(status=status.HTTP_200_OK, data={'msg': _('Test success')})
diff --git a/apps/settings/api/settings.py b/apps/settings/api/settings.py
index 4dda51408..2047faa08 100644
--- a/apps/settings/api/settings.py
+++ b/apps/settings/api/settings.py
@@ -34,6 +34,7 @@ class SettingsApi(generics.RetrieveUpdateAPIView):
         'sso': serializers.SSOSettingSerializer,
         'clean': serializers.CleaningSerializer,
         'other': serializers.OtherSettingSerializer,
+        'sms': serializers.SMSSettingSerializer,
         'alibaba': serializers.AlibabaSMSSettingSerializer,
         'tencent': serializers.TencentSMSSettingSerializer,
     }
diff --git a/apps/settings/api/tencent_sms.py b/apps/settings/api/tencent_sms.py
index 27ad07327..5395a1305 100644
--- a/apps/settings/api/tencent_sms.py
+++ b/apps/settings/api/tencent_sms.py
@@ -6,7 +6,6 @@ from rest_framework.exceptions import APIException
 from rest_framework import status
 from django.utils.translation import gettext_lazy as _
 
-from common.message.backends.sms import SMS_MESSAGE
 from common.message.backends.sms.tencent import TencentSMS
 from settings.models import Setting
 from common.permissions import IsSuperUser
@@ -25,7 +24,8 @@ class TencentSMSTestingAPI(GenericAPIView):
 
         tencent_secret_id = serializer.validated_data['TENCENT_SECRET_ID']
         tencent_secret_key = serializer.validated_data.get('TENCENT_SECRET_KEY')
-        tencent_sms_sign_and_tmpl = serializer.validated_data['TENCENT_SMS_SIGN_AND_TEMPLATES']
+        tencent_verify_sign_name = serializer.validated_data['TENCENT_VERIFY_SIGN_NAME']
+        tencent_verify_template_code = serializer.validated_data['TENCENT_VERIFY_TEMPLATE_CODE']
         tencent_sdkappid = serializer.validated_data.get('TENCENT_SDKAPPID')
 
         test_phone = serializer.validated_data.get('SMS_TEST_PHONE')
@@ -46,12 +46,11 @@ class TencentSMSTestingAPI(GenericAPIView):
                 secret_key=tencent_secret_key,
                 sdkappid=tencent_sdkappid
             )
-            sign, tmpl = SMS_MESSAGE.VERIFICATION_CODE.get_sign_and_tmpl(tencent_sms_sign_and_tmpl)
 
             client.send_sms(
                 phone_numbers=[test_phone],
-                sign_name=sign,
-                template_code=tmpl,
+                sign_name=tencent_verify_sign_name,
+                template_code=tencent_verify_template_code,
                 template_param=OrderedDict(code='test')
             )
             return Response(status=status.HTTP_200_OK, data={'msg': _('Test success')})
diff --git a/apps/settings/models.py b/apps/settings/models.py
index 1660e318d..0ad7d116d 100644
--- a/apps/settings/models.py
+++ b/apps/settings/models.py
@@ -86,20 +86,48 @@ class Setting(models.Model):
             setattr(settings, self.name, self.cleaned_value)
 
     @classmethod
-    def refresh_AUTH_LDAP(cls):
-        setting = cls.objects.filter(name='AUTH_LDAP').first()
+    def refresh_authentications(cls, name):
+        setting = cls.objects.filter(name=name).first()
         if not setting:
             return
-        ldap_backend = settings.AUTH_BACKEND_LDAP
-        backends = settings.AUTHENTICATION_BACKENDS
-        has = ldap_backend in backends
-        if setting.cleaned_value and not has:
-            settings.AUTHENTICATION_BACKENDS.insert(0, ldap_backend)
 
-        if not setting.cleaned_value and has:
-            index = backends.index(ldap_backend)
-            backends.pop(index)
-        settings.AUTH_LDAP = setting.cleaned_value
+        backends_map = {
+            'AUTH_LDAP': [settings.AUTH_BACKEND_LDAP],
+            'AUTH_OPENID': [settings.AUTH_BACKEND_OIDC_CODE, settings.AUTH_BACKEND_OIDC_PASSWORD],
+            'AUTH_RADIUS': [settings.AUTH_BACKEND_RADIUS],
+            'AUTH_CAS': [settings.AUTH_BACKEND_CAS],
+        }
+        setting_backends = backends_map[name]
+        auth_backends = settings.AUTHENTICATION_BACKENDS
+
+        for backend in setting_backends:
+            has = backend in auth_backends
+
+            # 添加
+            if setting.cleaned_value and not has:
+                logger.debug('Add auth backend: ', name)
+                settings.AUTHENTICATION_BACKENDS.insert(0, backend)
+
+            # 去掉
+            if not setting.cleaned_value and has:
+                index = auth_backends.index(backend)
+                logger.debug('Pop auth backend: ', name)
+                auth_backends.pop(index)
+
+        # 设置内存值
+        setattr(settings, name, setting.cleaned_value)
+
+    @classmethod
+    def refresh_AUTH_LDAP(cls):
+        cls.refresh_authentications('AUTH_LDAP')
+
+    @classmethod
+    def refresh_AUTH_OPENID(cls):
+        cls.refresh_authentications('AUTH_OPENID')
+
+    @classmethod
+    def refresh_AUTH_RADIUS(cls):
+        cls.refresh_authentications('AUTH_RADIUS')
 
     @classmethod
     def update_or_create(cls, name='', value='', encrypted=False, category=''):
diff --git a/apps/settings/serializers/auth/base.py b/apps/settings/serializers/auth/base.py
index d98816108..2873225b7 100644
--- a/apps/settings/serializers/auth/base.py
+++ b/apps/settings/serializers/auth/base.py
@@ -15,11 +15,12 @@ class AuthSettingSerializer(serializers.Serializer):
     AUTH_WECOM = serializers.BooleanField(default=False, label=_('WeCom Auth'))
     AUTH_SSO = serializers.BooleanField(default=False, label=_("SSO Auth"))
     FORGOT_PASSWORD_URL = serializers.CharField(
-        required=False, max_length=1024, label=_("Forgot password url")
-    )
-    HEALTH_CHECK_TOKEN = serializers.CharField(
-        required=False, max_length=1024, label=_("Health check token")
+        required=False, allow_blank=True, max_length=1024,
+        label=_("Forgot password url")
     )
+    # HEALTH_CHECK_TOKEN = serializers.CharField(
+    #     required=False, max_length=1024, label=_("Health check token")
+    # )
     LOGIN_REDIRECT_MSG_ENABLED = serializers.BooleanField(
         required=False, label=_("Enable login redirect msg")
     )
diff --git a/apps/settings/serializers/auth/sms.py b/apps/settings/serializers/auth/sms.py
index 275a8436e..8320b11eb 100644
--- a/apps/settings/serializers/auth/sms.py
+++ b/apps/settings/serializers/auth/sms.py
@@ -3,49 +3,42 @@ from rest_framework import serializers
 
 from common.message.backends.sms import BACKENDS
 
-__all__ = ['AlibabaSMSSettingSerializer', 'TencentSMSSettingSerializer']
+__all__ = ['SMSSettingSerializer', 'AlibabaSMSSettingSerializer', 'TencentSMSSettingSerializer']
+
+
+class SMSSettingSerializer(serializers.Serializer):
+    SMS_ENABLED = serializers.BooleanField(default=False, label=_('Enable SMS'))
+    SMS_BACKEND = serializers.ChoiceField(
+        choices=BACKENDS.choices, default=BACKENDS.ALIBABA, label=_('SMS provider')
+    )
+
+
+class SignTmplPairSerializer(serializers.Serializer):
+    SIGN_NAME = serializers.CharField(max_length=256, required=True, label=_('Signature'))
+    TEMPLATE_CODE = serializers.CharField(max_length=256, required=True, label=_('Template code'))
 
 
 class BaseSMSSettingSerializer(serializers.Serializer):
-    SMS_ENABLED = serializers.BooleanField(default=False, label=_('Enable SMS'))
-    SMS_TEST_PHONE = serializers.CharField(max_length=256, required=False, label=_('Test phone'))
+    SMS_TEST_PHONE = serializers.CharField(max_length=256, required=False, allow_blank=True, label=_('Test phone'))
 
     def to_representation(self, instance):
         data = super().to_representation(instance)
-        data['SMS_BACKEND'] = self.fields['SMS_BACKEND'].default
+        # data['SMS_BACKEND'] = self.fields['SMS_BACKEND'].default
         return data
 
 
 class AlibabaSMSSettingSerializer(BaseSMSSettingSerializer):
-    SMS_BACKEND = serializers.ChoiceField(choices=BACKENDS.choices, default=BACKENDS.ALIBABA)
     ALIBABA_ACCESS_KEY_ID = serializers.CharField(max_length=256, required=True, label='AccessKeyId')
     ALIBABA_ACCESS_KEY_SECRET = serializers.CharField(
-        max_length=256, required=False, label='AccessKeySecret', write_only=True)
-    ALIBABA_SMS_SIGN_AND_TEMPLATES = serializers.DictField(
-        label=_('Signatures and Templates'), required=True, help_text=_('''
-        Filling in JSON Data: 
-        {
-            "verification_code": {
-                "sign_name": "<Your signature name>", 
-                "template_code": "<Your template code>"
-            }
-        }
-        ''')
+        max_length=256, required=False, label='AccessKeySecret', write_only=True
     )
+    ALIBABA_VERIFY_SIGN_NAME = serializers.CharField(max_length=256, required=True, label=_('Signature'))
+    ALIBABA_VERIFY_TEMPLATE_CODE = serializers.CharField(max_length=256, required=True, label=_('Template code'))
 
 
 class TencentSMSSettingSerializer(BaseSMSSettingSerializer):
-    SMS_BACKEND = serializers.ChoiceField(choices=BACKENDS.choices, default=BACKENDS.TENCENT)
     TENCENT_SECRET_ID = serializers.CharField(max_length=256, required=True, label='Secret id')
     TENCENT_SECRET_KEY = serializers.CharField(max_length=256, required=False, label='Secret key', write_only=True)
     TENCENT_SDKAPPID = serializers.CharField(max_length=256, required=True, label='SDK app id')
-    TENCENT_SMS_SIGN_AND_TEMPLATES = serializers.DictField(
-        label=_('Signatures and Templates'), required=True, help_text=_('''
-        Filling in JSON Data: 
-        {
-            "verification_code": {
-                "sign_name": "<Your signature name>", 
-                "template_code": "<Your template code>"
-            }
-        }
-        '''))
+    TENCENT_VERIFY_SIGN_NAME = serializers.CharField(max_length=256, required=True, label=_('Signature'))
+    TENCENT_VERIFY_TEMPLATE_CODE = serializers.CharField(max_length=256, required=True, label=_('Template code'))
diff --git a/apps/settings/serializers/other.py b/apps/settings/serializers/other.py
index f8ebaeceb..131cdf5b4 100644
--- a/apps/settings/serializers/other.py
+++ b/apps/settings/serializers/other.py
@@ -1,5 +1,3 @@
-from abc import ABCMeta
-
 from django.utils.translation import ugettext_lazy as _
 from rest_framework import serializers
 
@@ -17,8 +15,13 @@ class OtherSettingSerializer(serializers.Serializer):
     OTP_VALID_WINDOW = serializers.IntegerField(label=_("OTP valid window"))
 
     PERIOD_TASK_ENABLED = serializers.BooleanField(required=False, label=_("Enable period task"))
-    WINDOWS_SSH_DEFAULT_SHELL = serializers.CharField(
-        required=False, max_length=1024, label=_('Ansible windows default shell')
+    WINDOWS_SSH_DEFAULT_SHELL = serializers.ChoiceField(
+        choices=[
+            ('cmd', _("CMD")),
+            ('powershell', _("PowerShell"))
+        ],
+        label=_('Shell (Windows)'),
+        help_text=_('The shell type used when Windows assets perform ansible tasks')
     )
 
     PERM_SINGLE_ASSET_TO_UNGROUP_NODE = serializers.BooleanField(
diff --git a/apps/settings/serializers/security.py b/apps/settings/serializers/security.py
index 5749a5c8f..1681b08a3 100644
--- a/apps/settings/serializers/security.py
+++ b/apps/settings/serializers/security.py
@@ -111,5 +111,8 @@ class SecuritySettingSerializer(SecurityPasswordRuleSerializer, SecurityAuthSeri
         required=True, label=_('Session share'),
         help_text=_("Enabled, Allows user active session to be shared with other users")
     )
-
+    LOGIN_CONFIRM_ENABLE = serializers.BooleanField(
+        required=False, label=_('Login Confirm'),
+        help_text=_("Enabled, please go to the user detail add approver")
+    )
 
diff --git a/apps/terminal/notifications.py b/apps/terminal/notifications.py
index 46ac5b18d..d7581d1e1 100644
--- a/apps/terminal/notifications.py
+++ b/apps/terminal/notifications.py
@@ -1,3 +1,5 @@
+from typing import Callable
+
 from django.utils.translation import gettext_lazy as _
 from django.conf import settings
 
@@ -7,6 +9,7 @@ from notifications.notifications import SystemMessage
 from terminal.models import Session, Command
 from notifications.models import SystemMsgSubscription
 from notifications.backends import BACKEND
+from common.utils import lazyproperty
 
 logger = get_logger(__name__)
 
@@ -17,19 +20,31 @@ CATEGORY_LABEL = _('Sessions')
 
 
 class CommandAlertMixin:
-    def get_dingtalk_msg(self) -> str:
-        msg = self._get_message()
-        msg = msg.replace('<br>', '')
-        return msg
+    command: dict
+    _get_message: Callable
+    message_type_label: str
+
+    @lazyproperty
+    def subject(self):
+        _input = self.command['input']
+        if isinstance(_input, str):
+            _input = _input.replace('\r\n', ' ').replace('\r', ' ').replace('\n', ' ')
+
+        subject = self.message_type_label + "%(cmd)s" % {
+            'cmd': _input
+        }
+        return subject
 
     @classmethod
     def post_insert_to_db(cls, subscription: SystemMsgSubscription):
         """
-        兼容操作，试图用 `settings.SECURITY_INSECURE_COMMAND_EMAIL_RECEIVER` 的邮件地址assets_systemuser_assets找到
-        用户，把用户设置为默认接收者
+        兼容操作，试图用 `settings.SECURITY_INSECURE_COMMAND_EMAIL_RECEIVER` 的邮件地址
+        assets_systemuser_assets找到用户，把用户设置为默认接收者
         """
         from settings.models import Setting
-        db_setting = Setting.objects.filter(name='SECURITY_INSECURE_COMMAND_EMAIL_RECEIVER').first()
+        db_setting = Setting.objects.filter(
+            name='SECURITY_INSECURE_COMMAND_EMAIL_RECEIVER'
+        ).first()
         if db_setting:
             emails = db_setting.value
         else:
@@ -52,61 +67,64 @@ class CommandAlertMessage(CommandAlertMixin, SystemMessage):
     def __init__(self, command):
         self.command = command
 
-    def _get_message(self):
+    def get_text_msg(self) -> dict:
         command = self.command
-        session_obj = Session.objects.get(id=command['session'])
+        session = Session.objects.get(id=command['session'])
+        session_detail_url = reverse(
+            'api-terminal:session-detail', kwargs={'pk': command['session']},
+            external=True, api_to_ui=True
+        )
 
         message = _("""
-                        Command: %(command)s
-                        <br>
-                        Asset: %(host_name)s (%(host_ip)s)
-                        <br>
-                        User: %(user)s
-                        <br>
-                        Level: %(risk_level)s
-                        <br>
-                        Session: <a href="%(session_detail_url)s">session detail</a>
-                        <br>
-                        """) % {
+Command: %(command)s
+Asset: %(hostname)s (%(host_ip)s)
+User: %(user)s
+Level: %(risk_level)s
+Session: %(session_detail_url)s?oid=%(oid)s
+        """) % {
             'command': command['input'],
-            'host_name': command['asset'],
-            'host_ip': session_obj.asset_obj.ip,
+            'hostname': command['asset'],
+            'host_ip': session.asset_obj.ip,
             'user': command['user'],
             'risk_level': Command.get_risk_level_str(command['risk_level']),
-            'session_detail_url': reverse('api-terminal:session-detail',
-                                          kwargs={'pk': command['session']},
-                                          external=True, api_to_ui=True),
+            'session_detail_url': session_detail_url,
+            'oid': session.org_id
         }
-
-        return message
-
-    def get_common_msg(self):
-        msg = self._get_message()
-
         return {
-            'subject': msg[:80],
-            'message': msg
+            'subject': self.subject,
+            'message': message
         }
 
-    def get_email_msg(self):
+    def get_html_msg(self) -> dict:
         command = self.command
-        session_obj = Session.objects.get(id=command['session'])
+        session = Session.objects.get(id=command['session'])
+        session_detail_url = reverse(
+            'api-terminal:session-detail', kwargs={'pk': command['session']},
+            external=True, api_to_ui=True
+        )
 
-        input = command['input']
-        if isinstance(input, str):
-            input = input.replace('\r\n', ' ').replace('\r', ' ').replace('\n', ' ')
-
-        subject = _("Insecure Command Alert: [%(name)s->%(login_from)s@%(remote_addr)s] $%(command)s") % {
-            'name': command['user'],
-            'login_from': session_obj.get_login_from_display(),
-            'remote_addr': session_obj.remote_addr,
-            'command': input
+        message = _("""
+            Command: %(command)s
+            <br>
+            Asset: %(hostname)s (%(host_ip)s)
+            <br>
+            User: %(user)s
+            <br>
+            Level: %(risk_level)s
+            <br>
+            Session: <a href="%(session_detail_url)s?oid=%(oid)s">session detail</a>
+            <br>
+        """) % {
+            'command': command['input'],
+            'hostname': command['asset'],
+            'host_ip': session.asset_obj.ip,
+            'user': command['user'],
+            'risk_level': Command.get_risk_level_str(command['risk_level']),
+            'session_detail_url': session_detail_url,
+            'oid': session.org_id
         }
-
-        message = self._get_message()
-
         return {
-            'subject': subject,
+            'subject': self.subject,
             'message': message
         }
 
@@ -119,10 +137,10 @@ class CommandExecutionAlert(CommandAlertMixin, SystemMessage):
     def __init__(self, command):
         self.command = command
 
-    def _get_message(self):
+    def get_html_msg(self) -> dict:
         command = self.command
-        input = command['input']
-        input = input.replace('\n', '<br>')
+        _input = command['input']
+        _input = _input.replace('\n', '<br>')
 
         assets = ', '.join([str(asset) for asset in command['assets']])
         message = _("""
@@ -137,22 +155,36 @@ class CommandExecutionAlert(CommandAlertMixin, SystemMessage):
                             %(command)s <br>
                             ----------------- Commands ---------------- <br>
                             """) % {
-            'command': input,
+            'command': _input,
             'assets': assets,
             'user': command['user'],
-            'risk_level': Command.get_risk_level_str(command['risk_level']),
+            'risk_level': Command.get_risk_level_str(command['risk_level'])
         }
-        return message
-
-    def get_common_msg(self):
-        command = self.command
-
-        subject = _("Insecure Web Command Execution Alert: [%(name)s]") % {
-            'name': command['user'],
-        }
-        message = self._get_message()
-
         return {
-            'subject': subject,
+            'subject': self.subject,
+            'message': message
+        }
+
+    def get_text_msg(self) -> dict:
+        command = self.command
+        _input = command['input']
+
+        assets = ', '.join([str(asset) for asset in command['assets']])
+        message = _("""
+Assets: %(assets)s
+User: %(user)s
+Level: %(risk_level)s
+
+Commands 👇 ------------
+%(command)s
+------------------------
+                            """) % {
+            'command': _input,
+            'assets': assets,
+            'user': command['user'],
+            'risk_level': Command.get_risk_level_str(command['risk_level'])
+        }
+        return {
+            'subject': self.subject,
             'message': message
         }
diff --git a/apps/terminal/startup.py b/apps/terminal/startup.py
index 0626911ef..f2d8d64e7 100644
--- a/apps/terminal/startup.py
+++ b/apps/terminal/startup.py
@@ -50,13 +50,21 @@ class BaseTerminal(object):
             time.sleep(self.interval)
 
     def get_or_register_terminal(self):
-        terminal = Terminal.objects.filter(name=self.name, type=self.type, is_deleted=False).first()
+        terminal = Terminal.objects.filter(
+            name=self.name, type=self.type, is_deleted=False
+        ).first()
         if not terminal:
             terminal = self.register_terminal()
+
+        terminal.remote_addr = self.remote_addr
+        terminal.save()
         return terminal
 
     def register_terminal(self):
-        data = {'name': self.name, 'type': self.type, 'remote_addr': self.remote_addr}
+        data = {
+            'name': self.name, 'type': self.type,
+            'remote_addr': self.remote_addr
+        }
         serializer = TerminalRegistrationSerializer(data=data)
         serializer.is_valid()
         terminal = serializer.save()
@@ -68,7 +76,8 @@ class CoreTerminal(BaseTerminal):
 
     def __init__(self):
         super().__init__(
-            suffix_name=TerminalTypeChoices.core.label, _type=TerminalTypeChoices.core.value
+            suffix_name=TerminalTypeChoices.core.label,
+            _type=TerminalTypeChoices.core.value
         )
 
 
@@ -76,5 +85,6 @@ class CoreTerminal(BaseTerminal):
 class CeleryTerminal(BaseTerminal):
     def __init__(self):
         super().__init__(
-            suffix_name=TerminalTypeChoices.celery.label, _type=TerminalTypeChoices.celery.value
+            suffix_name=TerminalTypeChoices.celery.label,
+            _type=TerminalTypeChoices.celery.value
         )
diff --git a/apps/tickets/handler/apply_application.py b/apps/tickets/handler/apply_application.py
index 8d03a995d..4bdd58984 100644
--- a/apps/tickets/handler/apply_application.py
+++ b/apps/tickets/handler/apply_application.py
@@ -37,8 +37,8 @@ class Handler(BaseHandler):
     def _construct_meta_body_of_open(self):
         apply_category_display = self.ticket.meta.get('apply_category_display')
         apply_type_display = self.ticket.meta.get('apply_type_display')
-        apply_applications = self.ticket.meta.get('apply_applications', [])
-        apply_system_users = self.ticket.meta.get('apply_system_users', [])
+        apply_applications = self.ticket.meta.get('apply_applications_display', [])
+        apply_system_users = self.ticket.meta.get('apply_system_users_display', [])
         apply_date_start = self.ticket.meta.get('apply_date_start')
         apply_date_expired = self.ticket.meta.get('apply_date_expired')
         applied_body = '''{}: {},
diff --git a/apps/tickets/handler/apply_asset.py b/apps/tickets/handler/apply_asset.py
index ae8ded3b1..42daf6742 100644
--- a/apps/tickets/handler/apply_asset.py
+++ b/apps/tickets/handler/apply_asset.py
@@ -32,8 +32,8 @@ class Handler(BaseHandler):
 
     # body
     def _construct_meta_body_of_open(self):
-        apply_assets = self.ticket.meta.get('apply_assets', [])
-        apply_system_users = self.ticket.meta.get('apply_system_users', [])
+        apply_assets = self.ticket.meta.get('apply_assets_display', [])
+        apply_system_users = self.ticket.meta.get('apply_system_users_display', [])
         apply_actions_display = self.ticket.meta.get('apply_actions_display', [])
         apply_date_start = self.ticket.meta.get('apply_date_start')
         apply_date_expired = self.ticket.meta.get('apply_date_expired')
diff --git a/apps/tickets/models/flow.py b/apps/tickets/models/flow.py
index 9f008f166..9542c4f2c 100644
--- a/apps/tickets/models/flow.py
+++ b/apps/tickets/models/flow.py
@@ -6,6 +6,7 @@ from django.utils.translation import ugettext_lazy as _
 from common.mixins.models import CommonModelMixin
 from common.db.encoder import ModelJSONFieldEncoder
 from orgs.mixins.models import OrgModelMixin
+from orgs.models import Organization
 from orgs.utils import tmp_to_root_org
 from ..const import TicketType, TicketApprovalLevel, TicketApprovalStrategy
 from ..signals import post_or_update_change_ticket_flow_approval
@@ -67,5 +68,5 @@ class TicketFlow(CommonModelMixin, OrgModelMixin):
         flows = cls.objects.all()
         cur_flow_types = flows.values_list('type', flat=True)
         with tmp_to_root_org():
-            diff_global_flows = cls.objects.exclude(type__in=cur_flow_types)
+            diff_global_flows = cls.objects.exclude(type__in=cur_flow_types).filter(org_id=Organization.ROOT_ID)
         return flows | diff_global_flows
diff --git a/apps/tickets/notifications.py b/apps/tickets/notifications.py
new file mode 100644
index 000000000..e39edee0f
--- /dev/null
+++ b/apps/tickets/notifications.py
@@ -0,0 +1,87 @@
+from urllib.parse import urljoin
+
+from django.conf import settings
+from django.utils.translation import ugettext as _
+
+from . import const
+from notifications.notifications import UserMessage
+from common.utils import get_logger
+
+logger = get_logger(__file__)
+
+EMAIL_TEMPLATE = '''
+    <div>
+        <p>
+            {title} 
+            <a href={ticket_detail_url}>
+                <strong>{ticket_detail_url_description}</strong>
+            </a>
+        </p>
+        <div>
+            {body}
+        </div>
+    </div>
+'''
+
+
+class BaseTicketMessage(UserMessage):
+
+    @property
+    def subject(self):
+        return _(self.title).format(self.ticket.title, self.ticket.get_type_display())
+
+    @property
+    def ticket_detail_url(self):
+        return urljoin(settings.SITE_URL, const.TICKET_DETAIL_URL.format(id=str(self.ticket.id)))
+
+    def get_text_msg(self) -> dict:
+        message = """
+        {title}: {ticket_detail_url} -> {ticket_detail_url_description}
+        {body}
+        """.format(
+            title=self.content_title,
+            ticket_detail_url=self.ticket_detail_url,
+            ticket_detail_url_description=_('click here to review'),
+            body=self.ticket.body
+        )
+        return {
+            'subject': self.subject,
+            'message': message
+        }
+
+    def get_html_msg(self) -> dict:
+        message = EMAIL_TEMPLATE.format(
+            title=self.content_title,
+            ticket_detail_url=self.ticket_detail_url,
+            ticket_detail_url_description=_('click here to review'),
+            body=self.ticket.body.replace('\n', '<br/>'),
+        )
+        return {
+            'subject': self.subject,
+            'message': message
+        }
+
+
+class TicketAppliedToAssignee(BaseTicketMessage):
+    title = 'New Ticket - {} ({})'
+
+    def __init__(self, user, ticket):
+        self.ticket = ticket
+        super().__init__(user)
+
+    @property
+    def content_title(self):
+        return _('Your has a new ticket, applicant - {}').format(str(self.ticket.applicant_display))
+
+
+class TicketProcessedToApplicant(BaseTicketMessage):
+    title = 'Ticket has processed - {} ({})'
+
+    def __init__(self, user, ticket, processor):
+        self.ticket = ticket
+        self.processor = processor
+        super().__init__(user)
+
+    @property
+    def content_title(self):
+        return _('Your ticket has been processed, processor - {}').format(str(self.processor))
diff --git a/apps/tickets/serializers/ticket/ticket.py b/apps/tickets/serializers/ticket/ticket.py
index ca5f6add1..82ac70122 100644
--- a/apps/tickets/serializers/ticket/ticket.py
+++ b/apps/tickets/serializers/ticket/ticket.py
@@ -149,7 +149,7 @@ class TicketFlowApproveSerializer(serializers.ModelSerializer):
         fields = fields_small + fields_m2m
         read_only_fields = ['level', 'assignees_display']
         extra_kwargs = {
-            'assignees': {'write_only': True, 'allow_empty': True}
+            'assignees': {'write_only': True, 'allow_empty': True, 'required': False}
         }
 
     def get_assignees_read_only(self, obj):
@@ -157,6 +157,12 @@ class TicketFlowApproveSerializer(serializers.ModelSerializer):
             return obj.assignees.values_list('id', flat=True)
         return []
 
+    def validate(self, attrs):
+        if attrs['strategy'] == TicketApprovalStrategy.custom_user and not attrs.get('assignees'):
+            error = _('Please select the Assignees')
+            raise serializers.ValidationError(error)
+        return super().validate(attrs)
+
 
 class TicketFlowSerializer(OrgResourceModelSerializerMixin):
     type_display = serializers.ReadOnlyField(source='get_type_display', label=_('Type display'))
diff --git a/apps/tickets/utils.py b/apps/tickets/utils.py
index 7999a5e1d..18de23371 100644
--- a/apps/tickets/utils.py
+++ b/apps/tickets/utils.py
@@ -1,66 +1,32 @@
 # -*- coding: utf-8 -*-
 #
-from urllib.parse import urljoin
 from django.conf import settings
-from django.utils.translation import ugettext as _
 
 from common.utils import get_logger
-from common.tasks import send_mail_async
-from . import const
+from .notifications import TicketAppliedToAssignee, TicketProcessedToApplicant
 
 logger = get_logger(__file__)
 
-EMAIL_TEMPLATE = '''
-    <div>
-        <p>
-            {title} 
-            <a href={ticket_detail_url}>
-                <strong>{ticket_detail_url_description}</strong>
-            </a>
-        </p>
-        <div>
-            {body}
-        </div>
-    </div>
-'''
-
 
 def send_ticket_applied_mail_to_assignees(ticket):
     assignees = ticket.current_node.first().ticket_assignees.all()
     if not assignees:
-        logger.debug("Not found assignees, ticket: {}({}), assignees: {}".format(
-            ticket, str(ticket.id), assignees)
-        )
+        logger.debug("Not found assignees, ticket: {}({}), assignees: {}".format(ticket, str(ticket.id), assignees))
         return
 
-    ticket_detail_url = urljoin(settings.SITE_URL, const.TICKET_DETAIL_URL.format(id=str(ticket.id)))
-    subject = _('New Ticket - {} ({})').format(ticket.title, ticket.get_type_display())
-    message = EMAIL_TEMPLATE.format(
-        title=_('Your has a new ticket, applicant - {}').format(str(ticket.applicant_display)),
-        ticket_detail_url=ticket_detail_url,
-        ticket_detail_url_description=_('click here to review'),
-        body=ticket.body.replace('\n', '<br/>'),
-    )
-    if settings.DEBUG:
-        logger.debug(message)
-    recipient_list = [i.assignee.email for i in assignees]
-    send_mail_async.delay(subject, message, recipient_list, html_message=message)
+    for assignee in assignees:
+        instance = TicketAppliedToAssignee(assignee, ticket)
+        if settings.DEBUG:
+            logger.debug(instance)
+        instance.publish_async()
 
 
 def send_ticket_processed_mail_to_applicant(ticket, processor):
     if not ticket.applicant:
         logger.error("Not found applicant: {}({})".format(ticket.title, ticket.id))
         return
-    processor_display = str(processor)
-    ticket_detail_url = urljoin(settings.SITE_URL, const.TICKET_DETAIL_URL.format(id=str(ticket.id)))
-    subject = _('Ticket has processed - {} ({})').format(ticket.title, processor_display)
-    message = EMAIL_TEMPLATE.format(
-        title=_('Your ticket has been processed, processor - {}').format(processor_display),
-        ticket_detail_url=ticket_detail_url,
-        ticket_detail_url_description=_('click here to review'),
-        body=ticket.body.replace('\n', '<br/>'),
-    )
+
+    instance = TicketProcessedToApplicant(ticket.applicant, ticket, processor)
     if settings.DEBUG:
-        logger.debug(message)
-    recipient_list = [ticket.applicant.email, ]
-    send_mail_async.delay(subject, message, recipient_list, html_message=message)
+        logger.debug(instance)
+    instance.publish_async()
diff --git a/apps/users/api/profile.py b/apps/users/api/profile.py
index 02bdda07c..372ed5809 100644
--- a/apps/users/api/profile.py
+++ b/apps/users/api/profile.py
@@ -72,6 +72,11 @@ class UserPasswordApi(generics.RetrieveUpdateAPIView):
     def get_object(self):
         return self.request.user
 
+    def update(self, request, *args, **kwargs):
+        resp = super().update(request, *args, **kwargs)
+        ResetPasswordSuccessMsg(self.request.user, request).publish_async()
+        return resp
+
 
 class UserPublicKeyApi(generics.RetrieveUpdateAPIView):
     permission_classes = (IsAuthenticated,)
diff --git a/apps/users/notifications.py b/apps/users/notifications.py
index 7d860ca14..a129c624e 100644
--- a/apps/users/notifications.py
+++ b/apps/users/notifications.py
@@ -6,38 +6,7 @@ from common.utils import reverse, get_request_ip_or_data, get_request_user_agent
 from notifications.notifications import UserMessage
 
 
-class BaseUserMessage(UserMessage):
-    def get_text_msg(self) -> dict:
-        raise NotImplementedError
-
-    def get_html_msg(self) -> dict:
-        raise NotImplementedError
-
-    @lazyproperty
-    def text_msg(self) -> dict:
-        return self.get_text_msg()
-
-    @lazyproperty
-    def html_msg(self) -> dict:
-        return self.get_html_msg()
-
-    def get_dingtalk_msg(self) -> dict:
-        return self.text_msg
-
-    def get_wecom_msg(self) -> dict:
-        return self.text_msg
-
-    def get_feishu_msg(self) -> dict:
-        return self.text_msg
-
-    def get_email_msg(self) -> dict:
-        return self.html_msg
-
-    def get_site_msg_msg(self) -> dict:
-        return self.html_msg
-
-
-class ResetPasswordMsg(BaseUserMessage):
+class ResetPasswordMsg(UserMessage):
     def get_text_msg(self) -> dict:
         user = self.user
         subject = _('Reset password')
@@ -104,7 +73,7 @@ Login direct 👇
         }
 
 
-class ResetPasswordSuccessMsg(BaseUserMessage):
+class ResetPasswordSuccessMsg(UserMessage):
     def __init__(self, user, request):
         super().__init__(user)
         self.ip_address = get_request_ip_or_data(request)
@@ -187,7 +156,7 @@ Browser: %(browser)s
         }
 
 
-class PasswordExpirationReminderMsg(BaseUserMessage):
+class PasswordExpirationReminderMsg(UserMessage):
     def get_text_msg(self) -> dict:
         user = self.user
 
@@ -263,7 +232,7 @@ Login direct 👇
         }
 
 
-class UserExpirationReminderMsg(BaseUserMessage):
+class UserExpirationReminderMsg(UserMessage):
     def get_text_msg(self) -> dict:
         subject = _('Expiration notice')
         message = _("""
@@ -303,7 +272,7 @@ In order not to affect your normal work, please contact the administrator for co
         }
 
 
-class ResetSSHKeyMsg(BaseUserMessage):
+class ResetSSHKeyMsg(UserMessage):
     def get_text_msg(self) -> dict:
         subject = _('SSH Key Reset')
         message = _("""
@@ -347,7 +316,7 @@ Login direct 👇
         }
 
 
-class ResetMFAMsg(BaseUserMessage):
+class ResetMFAMsg(UserMessage):
     def get_text_msg(self) -> dict:
         subject = _('MFA Reset')
         message = _("""
diff --git a/apps/users/serializers/profile.py b/apps/users/serializers/profile.py
index 74e8e460b..8f4175c08 100644
--- a/apps/users/serializers/profile.py
+++ b/apps/users/serializers/profile.py
@@ -101,7 +101,7 @@ class UserProfileSerializer(UserSerializer):
     )
     mfa_level = serializers.ChoiceField(choices=MFA_LEVEL_CHOICES, label=_('MFA'), required=False)
     guide_url = serializers.SerializerMethodField()
-    receive_backends = serializers.ListField(child=serializers.CharField())
+    receive_backends = serializers.ListField(child=serializers.CharField(), read_only=True)
 
     class Meta(UserSerializer.Meta):
         fields = UserSerializer.Meta.fields + [
diff --git a/apps/users/serializers/user.py b/apps/users/serializers/user.py
index 85fd40359..fd6bd8969 100644
--- a/apps/users/serializers/user.py
+++ b/apps/users/serializers/user.py
@@ -169,6 +169,16 @@ class UserSerializer(CommonBulkSerializerMixin, serializers.ModelSerializer):
             self.context['request'], self.context['view'], obj
         )
 
+    def update(self, instance, validated_data):
+        request = self.context.get('request')
+        if request:
+            user = request.user
+            if user.id == instance.id:
+                # 用户自己不能禁用启用自己
+                validated_data.pop('is_active', None)
+
+        return super(UserSerializer, self).update(instance, validated_data)
+
 
 class UserRetrieveSerializer(UserSerializer):
     login_confirm_settings = serializers.PrimaryKeyRelatedField(read_only=True,