code: func (s *AuthServer) AuthenticateSSHUser(req AuthenticateSSHRequest) (*SSHLoginResponse, error) {
  	clusterName, err := s.GetClusterName()
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	if err := s.AuthenticateUser(req.AuthenticateUserRequest); err != nil {
  		return nil, trace.Wrap(err)
  	}
  	user, err := s.GetUser(req.Username)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	roles, err := services.FetchRoles(user.GetRoles(), s, user.GetTraits())
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	// Return the host CA for this cluster only.
  	authority, err := s.GetCertAuthority(services.CertAuthID{
  		Type:       services.HostCA,
  		DomainName: clusterName.GetClusterName(),
  	}, false)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	hostCertAuthorities := []services.CertAuthority{
  		authority,
  	}
  
  	certs, err := s.generateUserCert(certRequest{
  		user:          user,
  		roles:         roles,
  		ttl:           req.TTL,
  		publicKey:     req.PublicKey,
  		compatibility: req.CompatibilityMode,
  	})
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	return &SSHLoginResponse{
  		Username:    req.Username,
  		Cert:        certs.ssh,
  		TLSCert:     certs.tls,
  		HostSigners: AuthoritiesToTrustedCerts(hostCertAuthorities),
  	}, nil
  }
docs: // AuthenticateSSHUser authenticates web user, creates and  returns web session
  // in case if authentication is successful