diff --git a/source/client/src/clientEnv.c b/source/client/src/clientEnv.c
index d2696fb355713a7f6597b825bfe807f9e2a31d20..0780593e7e045c8aa270b1f849dc4fd5d392e297 100644
--- a/source/client/src/clientEnv.c
+++ b/source/client/src/clientEnv.c
@@ -110,7 +110,7 @@ void* openTransporter(const char *user, const char *auth, int32_t numOfThread) {
   rpcInit.user = (char *)user;
   rpcInit.idleTime = tsShellActivityTimer * 1000;
   rpcInit.ckey = "key";
-//  rpcInit.spi = 1;
+  rpcInit.spi = 1;
   rpcInit.secret = (char *)auth;
 
   void* pDnodeConn = rpcOpen(&rpcInit);
diff --git a/source/client/src/clientImpl.c b/source/client/src/clientImpl.c
index 7d5199dfafd38e958cc70eabe278080f91719caf..9a0a6a11e9a4473f17d54d3793120020af80cc7b 100644
--- a/source/client/src/clientImpl.c
+++ b/source/client/src/clientImpl.c
@@ -562,7 +562,7 @@ STscObj* taosConnectImpl(const char *user, const char *auth, const char *db, uin
 
   tsem_wait(&pRequest->body.rspSem);
   if (pRequest->code != TSDB_CODE_SUCCESS) {
-    const char *errorMsg = (pRequest->code == TSDB_CODE_RPC_FQDN_ERROR) ? taos_errstr(pRequest) : tstrerror(terrno);
+    const char *errorMsg = (pRequest->code == TSDB_CODE_RPC_FQDN_ERROR) ? taos_errstr(pRequest) : tstrerror(pRequest->code);
     printf("failed to connect to server, reason: %s\n\n", errorMsg);
 
     destroyRequest(pRequest);
diff --git a/source/dnode/mgmt/impl/src/dndTransport.c b/source/dnode/mgmt/impl/src/dndTransport.c
index 104e702afb40e7e768d15e70a38eb776d1da2f6b..79464347f0d8293b9bba6164d1703ca607078579 100644
--- a/source/dnode/mgmt/impl/src/dndTransport.c
+++ b/source/dnode/mgmt/impl/src/dndTransport.c
@@ -179,9 +179,13 @@ static int32_t dndInitClient(SDnode *pDnode) {
   rpcInit.idleTime = pDnode->cfg.shellActivityTimer * 1000;
   rpcInit.user = INTERNAL_USER;
   rpcInit.ckey = INTERNAL_CKEY;
-  rpcInit.secret = INTERNAL_SECRET;
+  rpcInit.spi = 1;
   rpcInit.parent = pDnode;
 
+  char pass[TSDB_PASSWORD_LEN + 1] = {0};
+  taosEncryptPass_c((uint8_t *)(INTERNAL_SECRET), strlen(INTERNAL_SECRET), pass);
+  rpcInit.secret = pass;
+
   pMgmt->clientRpc = rpcOpen(&rpcInit);
   if (pMgmt->clientRpc == NULL) {
     dError("failed to init rpc client");
@@ -256,20 +260,18 @@ static void dndSendMsgToMnodeRecv(SDnode *pDnode, SRpcMsg *pRpcMsg, SRpcMsg *pRp
 
 static int32_t dndAuthInternalReq(SDnode *pDnode, char *user, char *spi, char *encrypt, char *secret, char *ckey) {
   if (strcmp(user, INTERNAL_USER) == 0) {
-    // A simple temporary implementation
-    char pass[TSDB_PASSWORD_LEN] = {0};
-    taosEncryptPass((uint8_t *)(INTERNAL_SECRET), strlen(INTERNAL_SECRET), pass);
+    char pass[TSDB_PASSWORD_LEN + 1] = {0};
+    taosEncryptPass_c((uint8_t *)(INTERNAL_SECRET), strlen(INTERNAL_SECRET), pass);
     memcpy(secret, pass, TSDB_PASSWORD_LEN);
-    *spi = 0;
+    *spi = 1;
     *encrypt = 0;
     *ckey = 0;
     return 0;
   } else if (strcmp(user, TSDB_NETTEST_USER) == 0) {
-    // A simple temporary implementation
-    char pass[TSDB_PASSWORD_LEN] = {0};
-    taosEncryptPass((uint8_t *)(TSDB_NETTEST_USER), strlen(TSDB_NETTEST_USER), pass);
+    char pass[TSDB_PASSWORD_LEN + 1] = {0};
+    taosEncryptPass_c((uint8_t *)(TSDB_NETTEST_USER), strlen(TSDB_NETTEST_USER), pass);
     memcpy(secret, pass, TSDB_PASSWORD_LEN);
-    *spi = 0;
+    *spi = 1;
     *encrypt = 0;
     *ckey = 0;
     return 0;
diff --git a/source/dnode/mgmt/impl/test/sut/src/client.cpp b/source/dnode/mgmt/impl/test/sut/src/client.cpp
index fd5dcd77d94ba40cb725e3b267fbce0bae6340df..3d61db8268b220f78433cb2fe36e9fe5583aa516 100644
--- a/source/dnode/mgmt/impl/test/sut/src/client.cpp
+++ b/source/dnode/mgmt/impl/test/sut/src/client.cpp
@@ -27,8 +27,8 @@ void TestClient::SetRpcRsp(SRpcMsg* pRsp) { this->pRsp = pRsp; };
 tsem_t* TestClient::GetSem() { return &sem; }
 
 bool TestClient::Init(const char* user, const char* pass, const char* fqdn, uint16_t port) {
-  char secretEncrypt[TSDB_PASSWORD_LEN] = {0};
-  taosEncryptPass((uint8_t*)pass, strlen(pass), secretEncrypt);
+  char secretEncrypt[TSDB_PASSWORD_LEN + 1] = {0};
+  taosEncryptPass_c((uint8_t*)pass, strlen(pass), secretEncrypt);
 
   SRpcInit rpcInit;
   memset(&rpcInit, 0, sizeof(rpcInit));
@@ -42,7 +42,7 @@ bool TestClient::Init(const char* user, const char* pass, const char* fqdn, uint
   rpcInit.ckey = (char*)"key";
   rpcInit.parent = this;
   rpcInit.secret = (char*)secretEncrypt;
-  // rpcInit.spi = 1;
+  rpcInit.spi = 1;
 
   clientRpc = rpcOpen(&rpcInit);
   ASSERT(clientRpc);
diff --git a/source/dnode/mnode/impl/src/mndAuth.c b/source/dnode/mnode/impl/src/mndAuth.c
index 3e9ab99a455036077081d94eae3eb7a4ecc2abb5..44a5836bd62a239cab71701fd652173ab33e3585 100644
--- a/source/dnode/mnode/impl/src/mndAuth.c
+++ b/source/dnode/mnode/impl/src/mndAuth.c
@@ -15,6 +15,7 @@
 
 #define _DEFAULT_SOURCE
 #include "mndAuth.h"
+#include "mndUser.h"
 
 static int32_t mndProcessAuthReq(SMnodeMsg *pReq);
 
@@ -25,7 +26,24 @@ int32_t mndInitAuth(SMnode *pMnode) {
 
 void mndCleanupAuth(SMnode *pMnode) {}
 
-int32_t mndRetriveAuth(SMnode *pMnode, char *user, char *spi, char *encrypt, char *secret, char *ckey) { return 0; }
+int32_t mndRetriveAuth(SMnode *pMnode, char *user, char *spi, char *encrypt, char *secret, char *ckey) {
+  SUserObj *pUser = mndAcquireUser(pMnode, user);
+  if (pUser == NULL) {
+    *secret = 0;
+    mError("user:%s, failed to auth user since %s", user, terrstr());
+    return -1;
+  }
+
+  *spi = 1;
+  *encrypt = 0;
+  *ckey = 0;
+
+  memcpy(secret, pUser->pass, TSDB_PASSWORD_LEN);
+  mndReleaseUser(pMnode, pUser);
+
+  mDebug("user:%s, auth info is returned", user);
+  return 0;
+}
 
 static int32_t mndProcessAuthReq(SMnodeMsg *pReq) {
   SAuthReq *pAuth = pReq->rpcMsg.pCont;
diff --git a/source/dnode/mnode/impl/src/mndUser.c b/source/dnode/mnode/impl/src/mndUser.c
index ad378953eb669a583c6bdd1aea3ad317211f2267..c36e1288938add3dc3e2b668afc6035991356bf4 100644
--- a/source/dnode/mnode/impl/src/mndUser.c
+++ b/source/dnode/mnode/impl/src/mndUser.c
@@ -60,9 +60,9 @@ void mndCleanupUser(SMnode *pMnode) {}
 
 static int32_t mndCreateDefaultUser(SMnode *pMnode, char *acct, char *user, char *pass) {
   SUserObj userObj = {0};
+  taosEncryptPass_c((uint8_t *)pass, strlen(pass), userObj.pass);
   tstrncpy(userObj.user, user, TSDB_USER_LEN);
   tstrncpy(userObj.acct, acct, TSDB_USER_LEN);
-  taosEncryptPass((uint8_t *)pass, strlen(pass), userObj.pass);
   userObj.createdTime = taosGetTimestampMs();
   userObj.updateTime = userObj.createdTime;
 
@@ -202,7 +202,7 @@ SUserObj *mndAcquireUser(SMnode *pMnode, char *userName) {
   SSdb     *pSdb = pMnode->pSdb;
   SUserObj *pUser = sdbAcquire(pSdb, SDB_USER, userName);
   if (pUser == NULL) {
-    terrno = TSDB_CODE_MND_DB_NOT_EXIST;
+    terrno = TSDB_CODE_MND_USER_NOT_EXIST;
   }
   return pUser;
 }
@@ -214,9 +214,9 @@ void mndReleaseUser(SMnode *pMnode, SUserObj *pUser) {
 
 static int32_t mndCreateUser(SMnode *pMnode, char *acct, char *user, char *pass, SMnodeMsg *pReq) {
   SUserObj userObj = {0};
+  taosEncryptPass_c((uint8_t *)pass, strlen(pass), userObj.pass);
   tstrncpy(userObj.user, user, TSDB_USER_LEN);
   tstrncpy(userObj.acct, acct, TSDB_USER_LEN);
-  taosEncryptPass((uint8_t *)pass, strlen(pass), userObj.pass);
   userObj.createdTime = taosGetTimestampMs();
   userObj.updateTime = userObj.createdTime;
   userObj.superUser = 0;
@@ -351,8 +351,9 @@ static int32_t mndProcessAlterUserReq(SMnodeMsg *pReq) {
 
   SUserObj newUser = {0};
   memcpy(&newUser, pUser, sizeof(SUserObj));
-  memset(pUser->pass, 0, sizeof(pUser->pass));
-  taosEncryptPass((uint8_t *)pAlter->pass, strlen(pAlter->pass), pUser->pass);
+  char pass[TSDB_PASSWORD_LEN + 1] = {0};
+  taosEncryptPass_c((uint8_t *)pAlter->pass, strlen(pAlter->pass), pass);
+  memcpy(pUser->pass, pass, TSDB_PASSWORD_LEN);
   newUser.updateTime = taosGetTimestampMs();
 
   int32_t code = mndUpdateUser(pMnode, pUser, &newUser, pReq);
diff --git a/source/dnode/mnode/sdb/src/sdbHash.c b/source/dnode/mnode/sdb/src/sdbHash.c
index a9267b0ea315ed6a873a43e712409a50072ddd1c..62472c8c8eea80c75a865f62cf36d7fe0385198f 100644
--- a/source/dnode/mnode/sdb/src/sdbHash.c
+++ b/source/dnode/mnode/sdb/src/sdbHash.c
@@ -152,6 +152,7 @@ static int32_t sdbInsertRow(SSdb *pSdb, SHashObj *hash, SSdbRaw *pRaw, SSdbRow *
   if (insertFp != NULL) {
     code = (*insertFp)(pSdb, pRow->pObj);
     if (code != 0) {
+      code = terrno;
       taosWLockLatch(pLock);
       taosHashRemove(hash, pRow->pObj, keySize);
       taosWUnLockLatch(pLock);
diff --git a/source/libs/executor/src/executorimpl.c b/source/libs/executor/src/executorimpl.c
index 4ce652f5fd9a80125f9d69d970a9346780c3c68a..2645b3eac81e982a0e7dd10458f3e16941a5d236 100644
--- a/source/libs/executor/src/executorimpl.c
+++ b/source/libs/executor/src/executorimpl.c
@@ -5302,7 +5302,7 @@ SOperatorInfo* createExchangeOperatorInfo(const SArray* pSources, const SArray*
     rpcInit.user = (char *)"root";
     rpcInit.idleTime = tsShellActivityTimer * 1000;
     rpcInit.ckey = "key";
-//  rpcInit.spi = 1;
+    rpcInit.spi = 1;
     rpcInit.secret = (char *)"dcc5bed04851fec854c035b2e40263b6";
 
     pInfo->pTransporter = rpcOpen(&rpcInit);
diff --git a/tools/shell/src/backup/tnettest.c b/tools/shell/src/backup/tnettest.c
index 7b5dbd2405caba1168715b8bbe00039008524016..be8714387f3e693dcdaf673e5dec959a39a18912 100644
--- a/tools/shell/src/backup/tnettest.c
+++ b/tools/shell/src/backup/tnettest.c
@@ -319,7 +319,7 @@ void *taosNetInitRpc(char *secretEncrypt, char spi) {
 
   char user[] = "nettestinternal";
   char pass[] = "nettestinternal";
-  taosEncryptPass((uint8_t *)pass, strlen(pass), secretEncrypt);
+  taosEncryptPass_c((uint8_t *)pass, strlen(pass), secretEncrypt);
 
   memset(&rpcInit, 0, sizeof(rpcInit));
   rpcInit.localPort = 0;
@@ -344,7 +344,7 @@ static int32_t taosNetCheckRpc(const char* serverFqdn, uint16_t port, uint16_t p
   SRpcMsg   rspMsg;
   void *    pRpcConn;
 
-  char secretEncrypt[32] = {0};
+  char secretEncrypt[TSDB_PASSWORD_LEN + 1] = {0};
 
   pRpcConn = taosNetInitRpc(secretEncrypt, spi);
   if (NULL == pRpcConn) {