diff --git a/internal/db/models/node_login_dao.go b/internal/db/models/node_login_dao.go
index 5b5e0dab..4f6232c0 100644
--- a/internal/db/models/node_login_dao.go
+++ b/internal/db/models/node_login_dao.go
@@ -155,3 +155,32 @@ func (this *NodeLoginDAO) FindFrequentPorts(tx *dbs.Tx) ([]int32, error) {
 	}
 	return ports, nil
 }
+
+func (this *NodeLoginDAO) FindFrequentGrantIds(tx *dbs.Tx, nodeClusterId int64, nsClusterId int64) ([]int64, error) {
+	var query = this.Query(tx).
+		Attr("state", NodeLoginStateEnabled).
+		Result("JSON_EXTRACT(params, '$.grantId') as `grantId`", "COUNT(*) AS c").
+		Having("grantId>0").
+		Desc("c").
+		Limit(3).
+		Group("grantId")
+	if nodeClusterId > 0 {
+		query.Attr("role", nodeconfigs.NodeRoleNode)
+		query.Where("(nodeId IN (SELECT id FROM "+SharedNodeDAO.Table+" WHERE state=1 AND clusterId=:clusterId))").
+			Param("clusterId", nodeClusterId)
+	} else if nsClusterId > 0 {
+		query.Attr("role", nodeconfigs.NodeRoleDNS)
+		query.Where("(nodeId IN (SELECT id FROM "+SharedNSNodeDAO.Table+" WHERE state=1 AND clusterId=:clusterId))").
+			Param("clusterId", nsClusterId)
+	}
+	ones, _, err := query.
+		FindOnes()
+	if err != nil {
+		return nil, err
+	}
+	var grantIds = []int64{}
+	for _, one := range ones {
+		grantIds = append(grantIds, one.GetInt64("grantId"))
+	}
+	return grantIds, nil
+}
diff --git a/internal/rpc/services/service_node_grant.go b/internal/rpc/services/service_node_grant.go
index 63283861..c4b09c61 100644
--- a/internal/rpc/services/service_node_grant.go
+++ b/internal/rpc/services/service_node_grant.go
@@ -265,3 +265,35 @@ func (this *NodeGrantService) TestNodeGrant(ctx context.Context, req *pb.TestNod
 	resp.IsOk = true
 	return resp, nil
 }
+
+// FindSuggestNodeGrants 查找集群推荐的认证
+func (this *NodeGrantService) FindSuggestNodeGrants(ctx context.Context, req *pb.FindSuggestNodeGrantsRequest) (*pb.FindSuggestNodeGrantsResponse, error) {
+	_, err := this.ValidateAdmin(ctx, 0)
+	if err != nil {
+		return nil, err
+	}
+
+	var pbGrants = []*pb.NodeGrant{}
+	var tx = this.NullTx()
+	grantIds, err := models.SharedNodeLoginDAO.FindFrequentGrantIds(tx, req.NodeClusterId, req.NsClusterId)
+	if err != nil {
+		return nil, err
+	}
+	for _, grantId := range grantIds {
+		grant, err := models.SharedNodeGrantDAO.FindEnabledNodeGrant(tx, grantId)
+		if err != nil {
+			return nil, err
+		}
+		if grant != nil {
+			pbGrants = append(pbGrants, &pb.NodeGrant{
+				Id:          int64(grant.Id),
+				Name:        grant.Name,
+				Method:      grant.Method,
+				Username:    grant.Username,
+				Su:          grant.Su == 1,
+				Description: grant.Description,
+			})
+		}
+	}
+	return &pb.FindSuggestNodeGrantsResponse{NodeGrants: pbGrants}, nil
+}