code: func (proxy *ProxyClient) dialAuthServer(ctx context.Context, clusterName string) (net.Conn, error) {
  	log.Debugf("Client %v is connecting to auth server on cluster %q.", proxy.clientAddr, clusterName)
  
  	address := "@" + clusterName
  
  	// parse destination first:
  	localAddr, err := utils.ParseAddr("tcp://" + proxy.proxyAddress)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	fakeAddr, err := utils.ParseAddr("tcp://" + address)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	proxySession, err := proxy.Client.NewSession()
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	proxyWriter, err := proxySession.StdinPipe()
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	proxyReader, err := proxySession.StdoutPipe()
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	proxyErr, err := proxySession.StderrPipe()
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	err = proxySession.RequestSubsystem("proxy:" + address)
  	if err != nil {
  		// read the stderr output from the failed SSH session and append
  		// it to the end of our own message:
  		serverErrorMsg, _ := ioutil.ReadAll(proxyErr)
  		return nil, trace.ConnectionProblem(err, "failed connecting to node %v. %s",
  			nodeName(strings.Split(address, "@")[0]), serverErrorMsg)
  	}
  	return utils.NewPipeNetConn(
  		proxyReader,
  		proxyWriter,
  		proxySession,
  		localAddr,
  		fakeAddr,
  	), nil
  }
docs: // dialAuthServer returns auth server connection forwarded via proxy