diff --git a/src/models/node.go b/src/models/node.go
index 00ef4f03e365a8a8206c00cddf2f8770fdb692c1..df9144a5401e629a623adac326f285df0adc1938 100644
--- a/src/models/node.go
+++ b/src/models/node.go
@@ -183,14 +183,22 @@ func (n *Node) CreateChild(ident, name, note, cate, creator string, leaf, proxy
 		return nil, fmt.Errorf("tenant node should be root node only")
 	}
 
+	if cate == "project" && (n.Cate != "tenant" && n.Cate != "organization") {
+		return nil, fmt.Errorf("project node should be under tenant or organization")
+	}
+
 	if ident == "" {
 		return nil, fmt.Errorf("ident is blank")
 	}
 
-	if !str.IsMatch(ident, "^[a-zA-Z0-9\\-\\_]+$") {
+	if !str.IsMatch(ident, "^[a-z0-9\\-\\_]+$") {
 		return nil, fmt.Errorf("ident invalid")
 	}
 
+	if len(ident) >= 32 {
+		return nil, fmt.Errorf("ident length should be less than 32")
+	}
+
 	if creator != "system" {
 		// 人为创建的节点，有些保留名字不能使用，是为了给PaaS各个子系统注册资源所用
 		if (n.Path == "inner" || n.Cate == "project") && slice.ContainsString(protectedNodeIdents, ident) {
diff --git a/src/modules/rdb/http/router_node.go b/src/modules/rdb/http/router_node.go
index e5be4cc3801246e59b2d4116bff7e5938ec67c94..d95f53de65848765a93118b2a45b7f6cfa7c7091 100644
--- a/src/modules/rdb/http/router_node.go
+++ b/src/modules/rdb/http/router_node.go
@@ -58,8 +58,12 @@ func (f nodeForm) Validate() {
 		bomb("arg[pid] invalid")
 	}
 
-	if !str.IsMatch(f.Ident, `^[a-zA-Z0-9\-_]+$`) {
-		bomb("ident legal characters: [a-zA-Z0-9_-]")
+	if !str.IsMatch(f.Ident, `^[a-z0-9\-_]+$`) {
+		bomb("ident legal characters: [a-z0-9_-]")
+	}
+
+	if len(f.Ident) >= 32 {
+		bomb("ident length should be less than 32")
 	}
 
 	if f.Leaf != 0 && f.Leaf != 1 {