code: func (h *AuthHandlers) canLoginWithRBAC(cert *ssh.Certificate, clusterName string, teleportUser, osUser string) error {
  	h.Debugf("Checking permissions for (%v,%v) to login to node with RBAC checks.", teleportUser, osUser)
  
  	// get the ca that signd the users certificate
  	ca, err := h.authorityForCert(services.UserCA, cert.SignatureKey)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  
  	// get roles assigned to this user
  	roles, err := h.fetchRoleSet(cert, ca, teleportUser, clusterName)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  
  	// check if roles allow access to server
  	if err := roles.CheckAccessToServer(osUser, h.Server.GetInfo()); err != nil {
  		return trace.AccessDenied("user %s@%s is not authorized to login as %v@%s: %v",
  			teleportUser, ca.GetClusterName(), osUser, clusterName, err)
  	}
  
  	return nil
  }
docs: // canLoginWithRBAC checks the given certificate (supplied by a connected
  // client) to see if this certificate can be allowed to login as user:login
  // pair to requested server and if RBAC rules allow login.