code: func (h *AuthHandlers) CreateIdentityContext(sconn *ssh.ServerConn) (IdentityContext, error) {
  	identity := IdentityContext{
  		TeleportUser: sconn.Permissions.Extensions[utils.CertTeleportUser],
  		Certificate:  []byte(sconn.Permissions.Extensions[utils.CertTeleportUserCertificate]),
  		Login:        sconn.User(),
  	}
  
  	clusterName, err := h.AccessPoint.GetClusterName()
  	if err != nil {
  		return IdentityContext{}, trace.Wrap(err)
  	}
  
  	certificate, err := identity.GetCertificate()
  	if err != nil {
  		return IdentityContext{}, trace.Wrap(err)
  	}
  	if certificate.ValidBefore != 0 {
  		identity.CertValidBefore = time.Unix(int64(certificate.ValidBefore), 0)
  	}
  
  	certAuthority, err := h.authorityForCert(services.UserCA, certificate.SignatureKey)
  	if err != nil {
  		return IdentityContext{}, trace.Wrap(err)
  	}
  	identity.CertAuthority = certAuthority
  
  	roleSet, err := h.fetchRoleSet(certificate, certAuthority, identity.TeleportUser, clusterName.GetClusterName())
  	if err != nil {
  		return IdentityContext{}, trace.Wrap(err)
  	}
  	identity.RoleSet = roleSet
  
  	return identity, nil
  }
docs: // BuildIdentityContext returns an IdentityContext populated with information
  // about the logged in user on the connection.