diff --git a/apps/emqx/src/emqx_authentication_config.erl b/apps/emqx/src/emqx_authentication_config.erl
index 046068f6a..93fcafc35 100644
--- a/apps/emqx/src/emqx_authentication_config.erl
+++ b/apps/emqx/src/emqx_authentication_config.erl
@@ -71,9 +71,15 @@ pre_config_update(_, UpdateReq, OldConfig) ->
     end.
 
 do_pre_config_update({create_authenticator, ChainName, Config}, OldConfig) ->
-    CertsDir = certs_dir(ChainName, Config),
-    NConfig = convert_certs(CertsDir, Config),
-    {ok, OldConfig ++ [NConfig]};
+    NewId = authenticator_id(Config),
+    case lists:filter(fun(OldConfig0) -> authenticator_id(OldConfig0) =:= NewId end, OldConfig) of
+        [] ->
+            CertsDir = certs_dir(ChainName, Config),
+            NConfig = convert_certs(CertsDir, Config),
+            {ok, OldConfig ++ [NConfig]};
+        [_] ->
+            {error, {already_exists, {authenticator, NewId}}}
+    end;
 do_pre_config_update({delete_authenticator, _ChainName, AuthenticatorID}, OldConfig) ->
     NewConfig = lists:filter(
         fun(OldConfig0) ->
@@ -257,9 +263,12 @@ clear_certs(CertsDir, Config) ->
     ok = emqx_tls_lib:delete_ssl_files(CertsDir, undefined, OldSSL).
 
 get_authenticator_config(AuthenticatorID, AuthenticatorsConfig) ->
-    case [C0 || C0 <- AuthenticatorsConfig, AuthenticatorID == authenticator_id(C0)] of
-        [C | _] -> C;
-        [] -> {error, not_found}
+    case
+        lists:filter(fun(C) -> AuthenticatorID =:= authenticator_id(C) end, AuthenticatorsConfig)
+    of
+        [C] -> C;
+        [] -> {error, not_found};
+        _ -> error({duplicated_authenticator_id, AuthenticatorsConfig})
     end.
 
 split_by_id(ID, AuthenticatorsConfig) ->
@@ -305,7 +314,7 @@ authenticator_id(#{mechanism := Mechanism}) ->
 authenticator_id(#{<<"mechanism">> := Mechanism, <<"backend">> := Backend}) ->
     <<Mechanism/binary, ":", Backend/binary>>;
 authenticator_id(#{<<"mechanism">> := Mechanism}) ->
-    Mechanism;
+    to_bin(Mechanism);
 authenticator_id(_C) ->
     throw({missing_parameter, #{name => mechanism}}).
 
diff --git a/apps/emqx_authn/test/emqx_authn_api_SUITE.erl b/apps/emqx_authn/test/emqx_authn_api_SUITE.erl
index 38e6c21b7..86fc1f66c 100644
--- a/apps/emqx_authn/test/emqx_authn_api_SUITE.erl
+++ b/apps/emqx_authn/test/emqx_authn_api_SUITE.erl
@@ -55,6 +55,7 @@ init_per_testcase(_, Config) ->
     Config.
 
 init_per_suite(Config) ->
+    emqx_config:erase(?EMQX_AUTHENTICATION_CONFIG_ROOT_NAME_BINARY),
     _ = application:load(emqx_conf),
     ok = emqx_common_test_helpers:start_apps(
         [emqx_authn, emqx_dashboard],
diff --git a/scripts/git-hook-pre-commit.sh b/scripts/git-hook-pre-commit.sh
index dc4e13e93..a5e441d05 100755
--- a/scripts/git-hook-pre-commit.sh
+++ b/scripts/git-hook-pre-commit.sh
@@ -11,4 +11,7 @@ if [[ "${files_dirty}" == '' ]] && [[ "${files_cached}" == '' ]]; then
 fi
 files="$(echo -e "${files_dirty} \n ${files_cached}" | xargs)"
 # shellcheck disable=SC2086
-./scripts/erlfmt $OPT $files
+if ! (./scripts/erlfmt $OPT $files); then
+    echo "EXECUTE 'make fmt' to fix" >&2
+    exit 1
+fi