code: func (h *AuthHandlers) CheckPortForward(addr string, ctx *ServerContext) error {
  	if ok := ctx.Identity.RoleSet.CanPortForward(); !ok {
  		systemErrorMessage := fmt.Sprintf("port forwarding not allowed by role set: %v", ctx.Identity.RoleSet)
  		userErrorMessage := "port forwarding not allowed"
  
  		// emit port forward failure event
  		h.AuditLog.EmitAuditEvent(events.PortForwardFailure, events.EventFields{
  			events.PortForwardAddr:    addr,
  			events.PortForwardSuccess: false,
  			events.PortForwardErr:     systemErrorMessage,
  			events.EventLogin:         ctx.Identity.Login,
  			events.EventUser:          ctx.Identity.TeleportUser,
  			events.LocalAddr:          ctx.Conn.LocalAddr().String(),
  			events.RemoteAddr:         ctx.Conn.RemoteAddr().String(),
  		})
  		h.Warnf("Port forwarding request denied: %v.", systemErrorMessage)
  
  		return trace.AccessDenied(userErrorMessage)
  	}
  
  	return nil
  }
docs: // CheckPortForward checks if port forwarding is allowed for the users RoleSet.