code: func (process *TeleportProcess) GetIdentity(role teleport.Role) (i *auth.Identity, err error) {
  	var found bool
  
  	process.Lock()
  	defer process.Unlock()
  
  	i, found = process.Identities[role]
  	if found {
  		return i, nil
  	}
  	i, err = process.storage.ReadIdentity(auth.IdentityCurrent, role)
  	id := auth.IdentityID{
  		Role:     role,
  		HostUUID: process.Config.HostUUID,
  		NodeName: process.Config.Hostname,
  	}
  	if err != nil {
  		if !trace.IsNotFound(err) {
  			return nil, trace.Wrap(err)
  		}
  		if role == teleport.RoleAdmin {
  			// for admin identity use local auth server
  			// because admin identity is requested by auth server
  			// itself
  			principals, dnsNames, err := process.getAdditionalPrincipals(role)
  			if err != nil {
  				return nil, trace.Wrap(err)
  			}
  			i, err = auth.GenerateIdentity(process.localAuth, id, principals, dnsNames)
  		} else {
  			// try to locate static identity provided in the file
  			i, err = process.findStaticIdentity(id)
  			if err != nil {
  				return nil, trace.Wrap(err)
  			}
  			process.Infof("Found static identity %v in the config file, writing to disk.", &id)
  			if err = process.storage.WriteIdentity(auth.IdentityCurrent, *i); err != nil {
  				return nil, trace.Wrap(err)
  			}
  		}
  	}
  	process.Identities[role] = i
  	return i, nil
  }
docs: // GetIdentity returns the process identity (credentials to the auth server) for a given
  // teleport Role. A teleport process can have any combination of 3 roles: auth, node, proxy
  // and they have their own identities