diff --git a/apps/emqx_authz/etc/emqx_authz.conf b/apps/emqx_authz/etc/emqx_authz.conf
index 8eadab38b..99b14f5fe 100644
--- a/apps/emqx_authz/etc/emqx_authz.conf
+++ b/apps/emqx_authz/etc/emqx_authz.conf
@@ -2,66 +2,56 @@ authorization {
     sources = [
        # {
        #      type: http
-       #      config: {
-       #          url: "https://emqx.com"
-       #          headers: {
-       #              Accept: "application/json"
-       #              Content-Type: "application/json"
-       #          }
+       #      url: "https://emqx.com"
+       #      headers: {
+       #          Accept: "application/json"
+       #          Content-Type: "application/json"
        #      }
        # },
        # {
        #     type: mysql
-       #     config: {
-       #        server: "127.0.0.1:3306"
-       #        database: mqtt
-       #        pool_size: 1
-       #        username: root
-       #        password: public
-       #        auto_reconnect: true
-       #        ssl: {
-       #          enable: true
-       #          cacertfile:  "{{ platform_etc_dir }}/certs/cacert.pem"
-       #          certfile: "{{ platform_etc_dir }}/certs/client-cert.pem"
-       #          keyfile: "{{ platform_etc_dir }}/certs/client-key.pem"
-       #        }
+       #     server: "127.0.0.1:3306"
+       #     database: mqtt
+       #     pool_size: 1
+       #     username: root
+       #     password: public
+       #     auto_reconnect: true
+       #     ssl: {
+       #       enable: true
+       #       cacertfile:  "{{ platform_etc_dir }}/certs/cacert.pem"
+       #       certfile: "{{ platform_etc_dir }}/certs/client-cert.pem"
+       #       keyfile: "{{ platform_etc_dir }}/certs/client-key.pem"
        #     }
        #     sql: "select ipaddress, username, clientid, action, permission, topic from mqtt_authz where ipaddr = '%a' or username = '%u' or clientid = '%c'"
        # },
        # {
        #     type: pgsql
-       #     config: {
-       #        server: "127.0.0.1:5432"
-       #        database: mqtt
-       #        pool_size: 1
-       #        username: root
-       #        password: public
-       #        auto_reconnect: true
-       #        ssl: {enable: false}
-       #     }
+       #     server: "127.0.0.1:5432"
+       #     database: mqtt
+       #     pool_size: 1
+       #     username: root
+       #     password: public
+       #     auto_reconnect: true
+       #     ssl: {enable: false}
        #     sql: "select ipaddress, username, clientid, action, permission, topic from mqtt_authz where ipaddr = '%a' or username = '%u' or username = '$all' or clientid = '%c'"
        # },
        # {
        #     type: redis
-       #     config: {
-       #        server: "127.0.0.1:6379"
-       #        database: 0
-       #        pool_size: 1
-       #        password: public
-       #        auto_reconnect: true
-       #        ssl: {enable: false}
-       #     }
+       #     server: "127.0.0.1:6379"
+       #     database: 0
+       #     pool_size: 1
+       #     password: public
+       #     auto_reconnect: true
+       #     ssl: {enable: false}
        #     cmd: "HGETALL mqtt_authz:%u"
        # },
        # {
        #     type: mongo
-       #     config: {
-       #        mongo_type: single
-       #        server: "127.0.0.1:27017"
-       #        pool_size: 1
-       #        database: mqtt
-       #        ssl: {enable: false}
-       #     }
+       #     mongo_type: single
+       #     server: "127.0.0.1:27017"
+       #     pool_size: 1
+       #     database: mqtt
+       #     ssl: {enable: false}
        #     collection: mqtt_authz
        #     find: { "$or": [ { "username": "%u" }, { "clientid": "%c" } ] }
        # },
diff --git a/apps/emqx_authz/src/emqx_authz.erl b/apps/emqx_authz/src/emqx_authz.erl
index f3b9a4793..0d116882c 100644
--- a/apps/emqx_authz/src/emqx_authz.erl
+++ b/apps/emqx_authz/src/emqx_authz.erl
@@ -224,10 +224,10 @@ init_source(#{enable := true,
     Source#{annotations => #{rules => Rules}};
 init_source(#{enable := true,
               type := http,
-              config := #{url := Url} = Config
+              url := Url
              } = Source) ->
-    NConfig = maps:merge(Config, #{base_url => maps:remove(query, Url)}),
-    case create_resource(Source#{config := NConfig}) of
+    NSource= maps:put(base_url, maps:remove(query, Url), Source),
+    case create_resource(NSource) of
         {error, Reason} -> error({load_config_error, Reason});
         Id -> Source#{annotations => #{id => Id}}
     end;
@@ -325,16 +325,14 @@ gen_id(Type) ->
     iolist_to_binary([io_lib:format("~s_~s",[?APP, Type])]).
 
 create_resource(#{type := DB,
-                  config := Config,
-                  annotations := #{id := ResourceID}}) ->
-    case emqx_resource:update(ResourceID, connector_module(DB), Config, []) of
+                  annotations := #{id := ResourceID}} = Source) ->
+    case emqx_resource:update(ResourceID, connector_module(DB), Source, []) of
         {ok, _} -> ResourceID;
         {error, Reason} -> {error, Reason}
     end;
-create_resource(#{type := DB,
-                  config := Config}) ->
+create_resource(#{type := DB} = Source) ->
     ResourceID = gen_id(DB),
-    case emqx_resource:create(ResourceID, connector_module(DB), Config) of
+    case emqx_resource:create(ResourceID, connector_module(DB), Source) of
         {ok, already_created} -> ResourceID;
         {ok, _} -> ResourceID;
         {error, Reason} -> {error, Reason}
diff --git a/apps/emqx_authz/src/emqx_authz_api_sources.erl b/apps/emqx_authz/src/emqx_authz_api_sources.erl
index 8bc99188e..b2d33eca5 100644
--- a/apps/emqx_authz/src/emqx_authz_api_sources.erl
+++ b/apps/emqx_authz/src/emqx_authz_api_sources.erl
@@ -24,11 +24,10 @@
 -define(EXAMPLE_REDIS,
         #{type=> redis,
           enable => true,
-          config => #{server => <<"127.0.0.1:3306">>,
-                      redis_type => single,
-                      pool_size => 1,
-                      auto_reconnect => true
-                     },
+          server => <<"127.0.0.1:3306">>,
+          redis_type => single,
+          pool_size => 1,
+          auto_reconnect => true,
           cmd => <<"HGETALL mqtt_authz">>}).
 -define(EXAMPLE_FILE,
         #{type=> file,
@@ -308,16 +307,16 @@ sources(get, _) ->
                                                          rules => [ io_lib:format("~p", [R])|| R <- Rules],
                                                          annotations => #{status => healthy}
                                                         }]);
-                              (#{type := _Type, config := Config, annotations := #{id := Id}} = Source, AccIn) ->
-                                  NSource0 = case maps:get(server, Config, undefined) of
+                              (#{type := _Type, annotations := #{id := Id}} = Source, AccIn) ->
+                                  NSource0 = case maps:get(server, Source, undefined) of
                                                  undefined -> Source;
                                                  Server ->
-                                                     Source#{config => Config#{server => emqx_connector_schema_lib:ip_port_to_string(Server)}}
+                                                     Source#{server => emqx_connector_schema_lib:ip_port_to_string(Server)}
                                              end,
-                                  NSource1 = case maps:get(servers, Config, undefined) of
+                                  NSource1 = case maps:get(servers, Source, undefined) of
                                                  undefined -> NSource0;
                                                  Servers ->
-                                                     NSource0#{config => Config#{servers => [emqx_connector_schema_lib:ip_port_to_string(Server) || Server <- Servers]}}
+                                                     NSource0#{servers => [emqx_connector_schema_lib:ip_port_to_string(Server) || Server <- Servers]}
                                              end,
                                   NSource2 = case emqx_resource:health_check(Id) of
                                                  ok ->
@@ -377,16 +376,16 @@ source(get, #{bindings := #{type := Type}}) ->
                     annotations => #{status => healthy}
                    }
             };
-        #{config := Config, annotations := #{id := Id}} = Source ->
-            NSource0 = case maps:get(server, Config, undefined) of
+        #{annotations := #{id := Id}} = Source ->
+            NSource0 = case maps:get(server, Source, undefined) of
                            undefined -> Source;
                            Server ->
-                               Source#{config => Config#{server => emqx_connector_schema_lib:ip_port_to_string(Server)}}
+                               Source#{server => emqx_connector_schema_lib:ip_port_to_string(Server)}
                        end,
-            NSource1 = case maps:get(servers, Config, undefined) of
+            NSource1 = case maps:get(servers, Source, undefined) of
                            undefined -> NSource0;
                            Servers ->
-                               NSource0#{config => Config#{servers => [emqx_connector_schema_lib:ip_port_to_string(Server) || Server <- Servers]}}
+                               NSource0#{servers => [emqx_connector_schema_lib:ip_port_to_string(Server) || Server <- Servers]}
                        end,
             NSource2 = case emqx_resource:health_check(Id) of
                 ok ->
@@ -434,7 +433,7 @@ move_source(post, #{bindings := #{type := Type}, body := #{<<"position">> := Pos
                     messgae => atom_to_binary(Reason)}}
     end.
 
-read_cert(#{config := #{ssl := #{enable := true} = SSL} = Config} = Source) ->
+read_cert(#{ssl := #{enable := true} = SSL} = Source) ->
     CaCert = case file:read_file(maps:get(cacertfile, SSL, "")) of
                  {ok, CaCert0} -> CaCert0;
                  _ -> ""
@@ -447,14 +446,14 @@ read_cert(#{config := #{ssl := #{enable := true} = SSL} = Config} = Source) ->
                  {ok, Key0} -> Key0;
                  _ -> ""
              end,
-    Source#{config => Config#{ssl => SSL#{cacertfile => CaCert,
-                                          certfile => Cert,
-                                          keyfile => Key
-                                         }}
+    Source#{ssl => SSL#{cacertfile => CaCert,
+                        certfile => Cert,
+                        keyfile => Key
+                       }
            };
 read_cert(Source) -> Source.
 
-write_cert(#{<<"config">> := #{<<"ssl">> := #{<<"enable">> := true} = SSL} = Config} = Source) ->
+write_cert(#{<<"ssl">> := #{<<"enable">> := true} = SSL} = Source) ->
     CertPath = filename:join([emqx:get_config([node, data_dir]), "certs"]),
     CaCert = case maps:is_key(<<"cacertfile">>, SSL) of
                  true ->
@@ -477,9 +476,9 @@ write_cert(#{<<"config">> := #{<<"ssl">> := #{<<"enable">> := true} = SSL} = Con
                      KeyFile;
                  false -> ""
              end,
-    Source#{<<"config">> := Config#{<<"ssl">> => SSL#{<<"cacertfile">> => CaCert,
-                                                      <<"certfile">> => Cert,
-                                                      <<"keyfile">> => Key}
+    Source#{<<"ssl">> => SSL#{<<"cacertfile">> => CaCert,
+                              <<"certfile">> => Cert,
+                              <<"keyfile">> => Key
                              }
            };
 write_cert(Source) -> Source.
diff --git a/apps/emqx_authz/src/emqx_authz_http.erl b/apps/emqx_authz/src/emqx_authz_http.erl
index c95d200e1..93aa634f3 100644
--- a/apps/emqx_authz/src/emqx_authz_http.erl
+++ b/apps/emqx_authz/src/emqx_authz_http.erl
@@ -35,12 +35,12 @@ description() ->
 
 authorize(Client, PubSub, Topic,
             #{type := http,
-              config := #{url := #{path := Path} = Url,
-                          headers := Headers,
-                          method := Method,
-                          request_timeout := RequestTimeout} = Config,
+              url := #{path := Path} = Url,
+              headers := Headers,
+              method := Method,
+              request_timeout := RequestTimeout,
               annotations := #{id := ResourceID}
-             }) ->
+             } = Source) ->
     Request = case Method of
                   get  -> 
                       Query = maps:get(query, Url, ""),
@@ -49,7 +49,7 @@ authorize(Client, PubSub, Topic,
                   _ ->
                       Body0 = serialize_body(
                                 maps:get('Accept', Headers, <<"application/json">>),
-                                maps:get(body, Config, #{})
+                                maps:get(body, Source, #{})
                               ),
                       Body1 = replvar(Body0, PubSub, Topic, Client),
                       Path1 = replvar(Path, PubSub, Topic, Client),
diff --git a/apps/emqx_authz/src/emqx_authz_schema.erl b/apps/emqx_authz/src/emqx_authz_schema.erl
index 7fb60bae2..4d8fa3579 100644
--- a/apps/emqx_authz/src/emqx_authz_schema.erl
+++ b/apps/emqx_authz/src/emqx_authz_schema.erl
@@ -20,7 +20,20 @@
 roots() -> ["authorization"].
 
 fields("authorization") ->
-    [ {sources, sources()}
+    [ {sources, #{type => union_array(
+                    [ hoconsc:ref(?MODULE, file)
+                    , hoconsc:ref(?MODULE, http_get)
+                    , hoconsc:ref(?MODULE, http_post)
+                    , hoconsc:ref(?MODULE, mongo_single)
+                    , hoconsc:ref(?MODULE, mongo_rs)
+                    , hoconsc:ref(?MODULE, mongo_sharded)
+                    , hoconsc:ref(?MODULE, mysql)
+                    , hoconsc:ref(?MODULE, pgsql)
+                    , hoconsc:ref(?MODULE, redis_single)
+                    , hoconsc:ref(?MODULE, redis_sentinel)
+                    , hoconsc:ref(?MODULE, redis_cluster)
+                    ])}
+      }
     ];
 fields(file) ->
     [ {type, #{type => file}}
@@ -34,17 +47,11 @@ fields(file) ->
                             end
               }}
     ];
-fields(http) ->
+fields(http_get) ->
     [ {type, #{type => http}}
     , {enable, #{type => boolean(),
                  default => true}}
-    , {config, #{type => hoconsc:union([ hoconsc:ref(?MODULE, http_get)
-                                       , hoconsc:ref(?MODULE, http_post)
-                                       ])}
-      }
-    ];
-fields(http_get) ->
-    [ {url, #{type => url()}}
+    , {url, #{type => url()}}
     , {headers, #{type => map(),
                   default => #{ <<"accept">> => <<"application/json">>
                               , <<"cache-control">> => <<"no-cache">>
@@ -68,7 +75,10 @@ fields(http_get) ->
     , {request_timeout,  #{type => timeout(), default => 30000 }}
     ]  ++ proplists:delete(base_url, emqx_connector_http:fields(config));
 fields(http_post) ->
-    [ {url, #{type => url()}}
+    [ {type, #{type => http}}
+    , {enable, #{type => boolean(),
+                 default => true}}
+    , {url, #{type => url()}}
     , {headers, #{type => map(),
                   default => #{ <<"accept">> => <<"application/json">>
                               , <<"cache-control">> => <<"no-cache">>
@@ -97,47 +107,36 @@ fields(http_post) ->
               }
       }
     ]  ++ proplists:delete(base_url, emqx_connector_http:fields(config));
-fields(mongo) ->
-    connector_fields(mongo) ++
+fields(mongo_single) ->
+    connector_fields(mongo, single) ++
+    [ {collection, #{type => atom()}}
+    , {find, #{type => map()}}
+    ];
+fields(mongo_rs) ->
+    connector_fields(mongo, rs) ++
+    [ {collection, #{type => atom()}}
+    , {find, #{type => map()}}
+    ];
+fields(mongo_sharded) ->
+    connector_fields(mongo, sharded) ++
     [ {collection, #{type => atom()}}
     , {find, #{type => map()}}
     ];
-fields(redis) ->
-    connector_fields(redis) ++
-    [ {cmd, query()} ];
 fields(mysql) ->
     connector_fields(mysql) ++
     [ {sql, query()} ];
 fields(pgsql) ->
     connector_fields(pgsql) ++
     [ {sql, query()} ];
-fields(username) ->
-    [{username, #{type => binary()}}];
-fields(clientid) ->
-    [{clientid, #{type => binary()}}];
-fields(ipaddress) ->
-    [{ipaddress, #{type => string()}}];
-fields(andlist) ->
-    [{'and', #{type => union_array(
-                         [ hoconsc:ref(?MODULE, username)
-                         , hoconsc:ref(?MODULE, clientid)
-                         , hoconsc:ref(?MODULE, ipaddress)
-                         ])
-              }
-     }
-    ];
-fields(orlist) ->
-    [{'or', #{type => union_array(
-                         [ hoconsc:ref(?MODULE, username)
-                         , hoconsc:ref(?MODULE, clientid)
-                         , hoconsc:ref(?MODULE, ipaddress)
-                         ])
-              }
-     }
-    ];
-fields(eq_topic) ->
-    [{eq, #{type => binary()}}].
-
+fields(redis_single) ->
+    connector_fields(redis, single) ++
+    [ {cmd, query()} ];
+fields(redis_sentinel) ->
+    connector_fields(redis, sentinel) ++
+    [ {cmd, query()} ];
+fields(redis_cluster) ->
+    connector_fields(redis, cluster) ++
+    [ {cmd, query()} ].
 
 %%--------------------------------------------------------------------
 %% Internal functions
@@ -146,17 +145,6 @@ fields(eq_topic) ->
 union_array(Item) when is_list(Item) ->
     hoconsc:array(hoconsc:union(Item)).
 
-sources() ->
-    #{type => union_array(
-                [ hoconsc:ref(?MODULE, file)
-                , hoconsc:ref(?MODULE, http)
-                , hoconsc:ref(?MODULE, mysql)
-                , hoconsc:ref(?MODULE, pgsql)
-                , hoconsc:ref(?MODULE, redis)
-                , hoconsc:ref(?MODULE, mongo)
-                ])
-    }.
-
 query() ->
     #{type => binary(),
       validator => fun(S) ->
@@ -168,6 +156,8 @@ query() ->
      }.
 
 connector_fields(DB) ->
+    connector_fields(DB, config).
+connector_fields(DB, Fields) ->
     Mod0 = io_lib:format("~s_~s",[emqx_connector, DB]),
     Mod = try
               list_to_existing_atom(Mod0)
@@ -180,4 +170,4 @@ connector_fields(DB) ->
     [ {type, #{type => DB}}
     , {enable, #{type => boolean(),
                  default => true}}
-    ] ++ Mod:roots().
+    ] ++ Mod:fields(Fields).
diff --git a/apps/emqx_authz/test/emqx_authz_SUITE.erl b/apps/emqx_authz/test/emqx_authz_SUITE.erl
index 88a0a9bf3..6e6597486 100644
--- a/apps/emqx_authz/test/emqx_authz_SUITE.erl
+++ b/apps/emqx_authz/test/emqx_authz_SUITE.erl
@@ -62,56 +62,51 @@ init_per_testcase(_, Config) ->
 
 -define(SOURCE1, #{<<"type">> => <<"http">>,
                    <<"enable">> => true,
-                   <<"config">> => #{
-                      <<"url">> => <<"https://fake.com:443/">>,
-                      <<"headers">> => #{},
-                      <<"method">> => <<"get">>,
-                      <<"request_timeout">> => 5000}
+                   <<"url">> => <<"https://fake.com:443/">>,
+                   <<"headers">> => #{},
+                   <<"method">> => <<"get">>,
+                   <<"request_timeout">> => 5000
                   }).
 -define(SOURCE2, #{<<"type">> => <<"mongo">>,
                    <<"enable">> => true,
-                   <<"config">> => #{
-                          <<"mongo_type">> => <<"single">>,
-                          <<"server">> => <<"127.0.0.1:27017">>,
-                          <<"pool_size">> => 1,
-                          <<"database">> => <<"mqtt">>,
-                          <<"ssl">> => #{<<"enable">> => false}},
+                   <<"mongo_type">> => <<"single">>,
+                   <<"server">> => <<"127.0.0.1:27017">>,
+                   <<"pool_size">> => 1,
+                   <<"database">> => <<"mqtt">>,
+                   <<"ssl">> => #{<<"enable">> => false},
                    <<"collection">> => <<"fake">>,
                    <<"find">> => #{<<"a">> => <<"b">>}
                   }).
 -define(SOURCE3, #{<<"type">> => <<"mysql">>,
                    <<"enable">> => true,
-                   <<"config">> => #{
-                       <<"server">> => <<"127.0.0.1:27017">>,
-                       <<"pool_size">> => 1,
-                       <<"database">> => <<"mqtt">>,
-                       <<"username">> => <<"xx">>,
-                       <<"password">> => <<"ee">>,
-                       <<"auto_reconnect">> => true,
-                       <<"ssl">> => #{<<"enable">> => false}},
+                   <<"server">> => <<"127.0.0.1:27017">>,
+                   <<"pool_size">> => 1,
+                   <<"database">> => <<"mqtt">>,
+                   <<"username">> => <<"xx">>,
+                   <<"password">> => <<"ee">>,
+                   <<"auto_reconnect">> => true,
+                   <<"ssl">> => #{<<"enable">> => false},
                    <<"sql">> => <<"abcb">>
                   }).
 -define(SOURCE4, #{<<"type">> => <<"pgsql">>,
                    <<"enable">> => true,
-                   <<"config">> => #{
-                       <<"server">> => <<"127.0.0.1:27017">>,
-                       <<"pool_size">> => 1,
-                       <<"database">> => <<"mqtt">>,
-                       <<"username">> => <<"xx">>,
-                       <<"password">> => <<"ee">>,
-                       <<"auto_reconnect">> => true,
-                       <<"ssl">> => #{<<"enable">> => false}},
+                   <<"server">> => <<"127.0.0.1:27017">>,
+                   <<"pool_size">> => 1,
+                   <<"database">> => <<"mqtt">>,
+                   <<"username">> => <<"xx">>,
+                   <<"password">> => <<"ee">>,
+                   <<"auto_reconnect">> => true,
+                   <<"ssl">> => #{<<"enable">> => false},
                    <<"sql">> => <<"abcb">>
                   }).
 -define(SOURCE5, #{<<"type">> => <<"redis">>,
                    <<"enable">> => true,
-                   <<"config">> => #{
-                       <<"server">> => <<"127.0.0.1:27017">>,
-                       <<"pool_size">> => 1,
-                       <<"database">> => 0,
-                       <<"password">> => <<"ee">>,
-                       <<"auto_reconnect">> => true,
-                       <<"ssl">> => #{<<"enable">> => false}},
+                   <<"server">> => <<"127.0.0.1:27017">>,
+                   <<"pool_size">> => 1,
+                   <<"database">> => 0,
+                   <<"password">> => <<"ee">>,
+                   <<"auto_reconnect">> => true,
+                   <<"ssl">> => #{<<"enable">> => false},
                    <<"cmd">> => <<"HGETALL mqtt_authz:%u">>
                   }).
 -define(SOURCE6, #{<<"type">> => <<"file">>,
diff --git a/apps/emqx_authz/test/emqx_authz_api_sources_SUITE.erl b/apps/emqx_authz/test/emqx_authz_api_sources_SUITE.erl
index bb2bb27e4..3c054aa7d 100644
--- a/apps/emqx_authz/test/emqx_authz_api_sources_SUITE.erl
+++ b/apps/emqx_authz/test/emqx_authz_api_sources_SUITE.erl
@@ -39,61 +39,55 @@
 
 -define(SOURCE1, #{<<"type">> => <<"http">>,
                    <<"enable">> => true,
-                   <<"config">> => #{
-                      <<"url">> => <<"https://fake.com:443/">>,
-                      <<"headers">> => #{},
-                      <<"method">> => <<"get">>,
-                      <<"request_timeout">> => 5000}
+                   <<"url">> => <<"https://fake.com:443/">>,
+                   <<"headers">> => #{},
+                   <<"method">> => <<"get">>,
+                   <<"request_timeout">> => 5000
                   }).
 -define(SOURCE2, #{<<"type">> => <<"mongo">>,
                    <<"enable">> => true,
-                   <<"config">> => #{
-                          <<"mongo_type">> => <<"sharded">>,
-                          <<"servers">> => [<<"127.0.0.1:27017">>,
-                                            <<"192.168.0.1:27017">>
-                                           ],
-                          <<"pool_size">> => 1,
-                          <<"database">> => <<"mqtt">>,
-                          <<"ssl">> => #{<<"enable">> => false}},
+                   <<"mongo_type">> => <<"sharded">>,
+                   <<"servers">> => [<<"127.0.0.1:27017">>,
+                                     <<"192.168.0.1:27017">>
+                                    ],
+                   <<"pool_size">> => 1,
+                   <<"database">> => <<"mqtt">>,
+                   <<"ssl">> => #{<<"enable">> => false},
                    <<"collection">> => <<"fake">>,
                    <<"find">> => #{<<"a">> => <<"b">>}
                   }).
 -define(SOURCE3, #{<<"type">> => <<"mysql">>,
                    <<"enable">> => true,
-                   <<"config">> => #{
-                       <<"server">> => <<"127.0.0.1:3306">>,
-                       <<"pool_size">> => 1,
-                       <<"database">> => <<"mqtt">>,
-                       <<"username">> => <<"xx">>,
-                       <<"password">> => <<"ee">>,
-                       <<"auto_reconnect">> => true,
-                       <<"ssl">> => #{<<"enable">> => false}},
+                   <<"server">> => <<"127.0.0.1:3306">>,
+                   <<"pool_size">> => 1,
+                   <<"database">> => <<"mqtt">>,
+                   <<"username">> => <<"xx">>,
+                   <<"password">> => <<"ee">>,
+                   <<"auto_reconnect">> => true,
+                   <<"ssl">> => #{<<"enable">> => false},
                    <<"sql">> => <<"abcb">>
                   }).
 -define(SOURCE4, #{<<"type">> => <<"pgsql">>,
                    <<"enable">> => true,
-                   <<"config">> => #{
-                       <<"server">> => <<"127.0.0.1:5432">>,
-                       <<"pool_size">> => 1,
-                       <<"database">> => <<"mqtt">>,
-                       <<"username">> => <<"xx">>,
-                       <<"password">> => <<"ee">>,
-                       <<"auto_reconnect">> => true,
-                       <<"ssl">> => #{<<"enable">> => false}},
+                   <<"server">> => <<"127.0.0.1:5432">>,
+                   <<"pool_size">> => 1,
+                   <<"database">> => <<"mqtt">>,
+                   <<"username">> => <<"xx">>,
+                   <<"password">> => <<"ee">>,
+                   <<"auto_reconnect">> => true,
+                   <<"ssl">> => #{<<"enable">> => false},
                    <<"sql">> => <<"abcb">>
                   }).
 -define(SOURCE5, #{<<"type">> => <<"redis">>,
                    <<"enable">> => true,
-                   <<"config">> => #{
-                       <<"servers">> => [<<"127.0.0.1:6379">>,
-                                         <<"127.0.0.1:6380">>
-                                        ],
-                       <<"pool_size">> => 1,
-                       <<"database">> => 0,
-                       <<"password">> => <<"ee">>,
-                       <<"auto_reconnect">> => true,
-                       <<"ssl">> => #{<<"enable">> => false}
-                      },
+                   <<"servers">> => [<<"127.0.0.1:6379">>,
+                                     <<"127.0.0.1:6380">>
+                                    ],
+                   <<"pool_size">> => 1,
+                   <<"database">> => 0,
+                   <<"password">> => <<"ee">>,
+                   <<"auto_reconnect">> => true,
+                   <<"ssl">> => #{<<"enable">> => false},
                    <<"cmd">> => <<"HGETALL mqtt_authz:%u">>
                   }).
 -define(SOURCE6, #{<<"type">> => <<"file">>,
@@ -207,27 +201,22 @@ t_api(_) ->
     {ok, 200, Result4} = request(get, uri(["authorization", "sources", "http"]), []),
     ?assertMatch(#{<<"type">> := <<"http">>, <<"enable">> := false}, jsx:decode(Result4)),
 
-    #{<<"config">> := Config} = ?SOURCE2,
-
-    dbg:tracer(),dbg:p(all,c),
-    dbg:tpl(emqx_authz_api_sources, read_cert, cx),
-    dbg:tpl(emqx_authz_api_sources, write_cert, cx),
     {ok, 204, _} = request(put, uri(["authorization", "sources", "mongo"]),
-                           ?SOURCE2#{<<"config">> := Config#{<<"ssl">> := #{
-                                                                 <<"enable">> => true,
-                                                                 <<"cacertfile">> => <<"fake cacert file">>,
-                                                                 <<"certfile">> => <<"fake cert file">>,
-                                                                 <<"keyfile">> => <<"fake key file">>,
-                                                                 <<"verify">> => false
-                                                                }}}),
+                           ?SOURCE2#{<<"ssl">> := #{
+                                         <<"enable">> => true,
+                                         <<"cacertfile">> => <<"fake cacert file">>,
+                                         <<"certfile">> => <<"fake cert file">>,
+                                         <<"keyfile">> => <<"fake key file">>,
+                                         <<"verify">> => false
+                                        }}),
     {ok, 200, Result5} = request(get, uri(["authorization", "sources", "mongo"]), []),
     ?assertMatch(#{<<"type">> := <<"mongo">>,
-                   <<"config">> := #{<<"ssl">> := #{<<"enable">> := true,
-                                                    <<"cacertfile">> := <<"fake cacert file">>,
-                                                    <<"certfile">> := <<"fake cert file">>,
-                                                    <<"keyfile">> := <<"fake key file">>,
-                                                    <<"verify">> := false
-                                                   }}
+                   <<"ssl">> := #{<<"enable">> := true,
+                                  <<"cacertfile">> := <<"fake cacert file">>,
+                                  <<"certfile">> := <<"fake cert file">>,
+                                  <<"keyfile">> := <<"fake key file">>,
+                                  <<"verify">> := false
+                                 }
                   }, jsx:decode(Result5)),
     ?assert(filelib:is_file(filename:join([emqx:get_config([node, data_dir]), "certs", "cacert-fake.pem"]))),
     ?assert(filelib:is_file(filename:join([emqx:get_config([node, data_dir]), "certs", "cert-fake.pem"]))),
diff --git a/apps/emqx_authz/test/emqx_authz_http_SUITE.erl b/apps/emqx_authz/test/emqx_authz_http_SUITE.erl
index fad5e9580..17763d993 100644
--- a/apps/emqx_authz/test/emqx_authz_http_SUITE.erl
+++ b/apps/emqx_authz/test/emqx_authz_http_SUITE.erl
@@ -47,12 +47,11 @@ init_per_suite(Config) ->
     {ok, _} = emqx:update_config([authorization, cache, enable], false),
     {ok, _} = emqx:update_config([authorization, no_match], deny),
     Rules = [#{<<"type">> => <<"http">>,
-               <<"config">> => #{
-                   <<"url">> => <<"https://fake.com:443/">>,
-                   <<"headers">> => #{},
-                   <<"method">> => <<"get">>,
-                   <<"request_timeout">> => 5000
-               }}
+               <<"url">> => <<"https://fake.com:443/">>,
+               <<"headers">> => #{},
+               <<"method">> => <<"get">>,
+               <<"request_timeout">> => 5000
+              }
             ],
     {ok, _} = emqx_authz:update(replace, Rules),
     Config.
diff --git a/apps/emqx_authz/test/emqx_authz_mongo_SUITE.erl b/apps/emqx_authz/test/emqx_authz_mongo_SUITE.erl
index db111ce83..8f4a6f29f 100644
--- a/apps/emqx_authz/test/emqx_authz_mongo_SUITE.erl
+++ b/apps/emqx_authz/test/emqx_authz_mongo_SUITE.erl
@@ -47,12 +47,11 @@ init_per_suite(Config) ->
     {ok, _} = emqx:update_config([authorization, cache, enable], false),
     {ok, _} = emqx:update_config([authorization, no_match], deny),
     Rules = [#{<<"type">> => <<"mongo">>,
-               <<"config">> => #{
-                      <<"mongo_type">> => <<"single">>,
-                      <<"server">> => <<"127.0.0.1:27017">>,
-                      <<"pool_size">> => 1,
-                      <<"database">> => <<"mqtt">>,
-                      <<"ssl">> => #{<<"enable">> => false}},
+               <<"mongo_type">> => <<"single">>,
+               <<"server">> => <<"127.0.0.1:27017">>,
+               <<"pool_size">> => 1,
+               <<"database">> => <<"mqtt">>,
+               <<"ssl">> => #{<<"enable">> => false},
                <<"collection">> => <<"fake">>,
                <<"find">> => #{<<"a">> => <<"b">>}
               }],
diff --git a/apps/emqx_authz/test/emqx_authz_mysql_SUITE.erl b/apps/emqx_authz/test/emqx_authz_mysql_SUITE.erl
index 0675e1caf..1173b0e3e 100644
--- a/apps/emqx_authz/test/emqx_authz_mysql_SUITE.erl
+++ b/apps/emqx_authz/test/emqx_authz_mysql_SUITE.erl
@@ -48,14 +48,13 @@ init_per_suite(Config) ->
     {ok, _} = emqx:update_config([authorization, cache, enable], false),
     {ok, _} = emqx:update_config([authorization, no_match], deny),
     Rules = [#{<<"type">> => <<"mysql">>,
-               <<"config">> => #{
-                   <<"server">> => <<"127.0.0.1:27017">>,
-                   <<"pool_size">> => 1,
-                   <<"database">> => <<"mqtt">>,
-                   <<"username">> => <<"xx">>,
-                   <<"password">> => <<"ee">>,
-                   <<"auto_reconnect">> => true,
-                   <<"ssl">> => #{<<"enable">> => false}},
+               <<"server">> => <<"127.0.0.1:27017">>,
+               <<"pool_size">> => 1,
+               <<"database">> => <<"mqtt">>,
+               <<"username">> => <<"xx">>,
+               <<"password">> => <<"ee">>,
+               <<"auto_reconnect">> => true,
+               <<"ssl">> => #{<<"enable">> => false},
                <<"sql">> => <<"abcb">>
               }],
     {ok, _} = emqx_authz:update(replace, Rules),
diff --git a/apps/emqx_authz/test/emqx_authz_pgsql_SUITE.erl b/apps/emqx_authz/test/emqx_authz_pgsql_SUITE.erl
index 6880ab405..24c2e7b35 100644
--- a/apps/emqx_authz/test/emqx_authz_pgsql_SUITE.erl
+++ b/apps/emqx_authz/test/emqx_authz_pgsql_SUITE.erl
@@ -48,14 +48,13 @@ init_per_suite(Config) ->
     {ok, _} = emqx:update_config([authorization, cache, enable], false),
     {ok, _} = emqx:update_config([authorization, no_match], deny),
     Rules = [#{<<"type">> => <<"pgsql">>,
-               <<"config">> => #{
-                   <<"server">> => <<"127.0.0.1:27017">>,
-                   <<"pool_size">> => 1,
-                   <<"database">> => <<"mqtt">>,
-                   <<"username">> => <<"xx">>,
-                   <<"password">> => <<"ee">>,
-                   <<"auto_reconnect">> => true,
-                   <<"ssl">> => #{<<"enable">> => false}},
+               <<"server">> => <<"127.0.0.1:27017">>,
+               <<"pool_size">> => 1,
+               <<"database">> => <<"mqtt">>,
+               <<"username">> => <<"xx">>,
+               <<"password">> => <<"ee">>,
+               <<"auto_reconnect">> => true,
+               <<"ssl">> => #{<<"enable">> => false},
                <<"sql">> => <<"abcb">>
               }],
     {ok, _} = emqx_authz:update(replace, Rules),
diff --git a/apps/emqx_authz/test/emqx_authz_redis_SUITE.erl b/apps/emqx_authz/test/emqx_authz_redis_SUITE.erl
index 09682761d..9949e8b51 100644
--- a/apps/emqx_authz/test/emqx_authz_redis_SUITE.erl
+++ b/apps/emqx_authz/test/emqx_authz_redis_SUITE.erl
@@ -47,13 +47,12 @@ init_per_suite(Config) ->
     {ok, _} = emqx:update_config([authorization, cache, enable], false),
     {ok, _} = emqx:update_config([authorization, no_match], deny),
     Rules = [#{<<"type">> => <<"redis">>,
-               <<"config">> => #{
-                   <<"server">> => <<"127.0.0.1:27017">>,
-                   <<"pool_size">> => 1,
-                   <<"database">> => 0,
-                   <<"password">> => <<"ee">>,
-                   <<"auto_reconnect">> => true,
-                   <<"ssl">> => #{<<"enable">> => false}},
+               <<"server">> => <<"127.0.0.1:27017">>,
+               <<"pool_size">> => 1,
+               <<"database">> => 0,
+               <<"password">> => <<"ee">>,
+               <<"auto_reconnect">> => true,
+               <<"ssl">> => #{<<"enable">> => false},
                <<"cmd">> => <<"HGETALL mqtt_authz:%u">>
               }],
     {ok, _} = emqx_authz:update(replace, Rules),