code: func (h *AuthHandlers) canLoginWithoutRBAC(cert *ssh.Certificate, clusterName string, teleportUser, osUser string) error {
  	h.Debugf("Checking permissions for (%v,%v) to login to node without RBAC checks.", teleportUser, osUser)
  
  	// check if the ca that signed the certificate is known to the cluster
  	_, err := h.authorityForCert(services.UserCA, cert.SignatureKey)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  
  	return nil
  }
docs: // canLoginWithoutRBAC checks the given certificate (supplied by a connected
  // client) to see if this certificate can be allowed to login as user:login
  // pair to requested server.