code: func (h *AuthHandlers) fetchRoleSet(cert *ssh.Certificate, ca services.CertAuthority, teleportUser string, clusterName string) (services.RoleSet, error) {
  	// for local users, go and check their individual permissions
  	var roles services.RoleSet
  	if clusterName == ca.GetClusterName() {
  		u, err := h.AccessPoint.GetUser(teleportUser)
  		if err != nil {
  			return nil, trace.Wrap(err)
  		}
  		// Pass along the traits so we get the substituted roles for this user.
  		roles, err = services.FetchRoles(u.GetRoles(), h.AccessPoint, u.GetTraits())
  		if err != nil {
  			return nil, trace.Wrap(err)
  		}
  	} else {
  		certRoles, err := extractRolesFromCert(cert)
  		if err != nil {
  			return nil, trace.AccessDenied("failed to parse certificate roles")
  		}
  		roleNames, err := ca.CombinedMapping().Map(certRoles)
  		if err != nil {
  			return nil, trace.AccessDenied("failed to map roles")
  		}
  		// pass the principals on the certificate along as the login traits
  		// to the remote cluster.
  		traits := map[string][]string{
  			teleport.TraitLogins: cert.ValidPrincipals,
  		}
  		roles, err = services.FetchRoles(roleNames, h.AccessPoint, traits)
  		if err != nil {
  			return nil, trace.Wrap(err)
  		}
  	}
  
  	return roles, nil
  }
docs: // fetchRoleSet fetches the services.RoleSet assigned to a Teleport user.