code: func extractRolesFromCert(cert *ssh.Certificate) ([]string, error) {
  	data, ok := cert.Extensions[teleport.CertExtensionTeleportRoles]
  	if !ok {
  		// it's ok to not have any roles in the metadata
  		return nil, nil
  	}
  	return services.UnmarshalCertRoles(data)
  }
docs: // extractRolesFromCert extracts roles from certificate metadata extensions.