code: func SetupUser(process *service.TeleportProcess, username string, roles []services.Role) error {
  	auth := process.GetAuthServer()
  	teleUser, err := services.NewUser(username)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  	if len(roles) == 0 {
  		role := services.RoleForUser(teleUser)
  		role.SetLogins(services.Allow, []string{username})
  
  		// allow tests to forward agent, still needs to be passed in client
  		roleOptions := role.GetOptions()
  		roleOptions.ForwardAgent = services.NewBool(true)
  		role.SetOptions(roleOptions)
  
  		err = auth.UpsertRole(role)
  		if err != nil {
  			return trace.Wrap(err)
  		}
  		teleUser.AddRole(role.GetMetadata().Name)
  		roles = append(roles, role)
  	} else {
  		for _, role := range roles {
  			err := auth.UpsertRole(role)
  			if err != nil {
  				return trace.Wrap(err)
  			}
  			teleUser.AddRole(role.GetName())
  		}
  	}
  	err = auth.UpsertUser(teleUser)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  	return nil
  }
docs: // SetupUser sets up user in the cluster