code: func (process *TeleportProcess) newClient(authServers []utils.NetAddr, identity *auth.Identity) (*auth.Client, bool, error) {
  	directClient, err := process.newClientDirect(authServers, identity)
  	if err != nil {
  		return nil, false, trace.Wrap(err)
  	}
  
  	// Try and connect to the Auth Server. If the request fails, try and
  	// connect through a tunnel.
  	log.Debugf("Attempting to connect to Auth Server directly.")
  	_, err = directClient.GetLocalClusterName()
  	if err != nil {
  		// Only attempt to connect through the proxy for nodes.
  		if identity.ID.Role != teleport.RoleNode {
  			return nil, false, trace.Wrap(err)
  		}
  
  		log.Debugf("Attempting to connect to Auth Server through tunnel.")
  		tunnelClient, er := process.newClientThroughTunnel(authServers, identity)
  		if er != nil {
  			return nil, false, trace.NewAggregate(err, er)
  		}
  
  		log.Debugf("Connected to Auth Server through tunnel.")
  		return tunnelClient, true, nil
  	}
  
  	log.Debugf("Connected to Auth Server with direct connection.")
  	return directClient, false, nil
  }
docs: // newClient attempts to connect directly to the Auth Server. If it fails, it
  // falls back to trying to connect to the Auth Server through the proxy.