code: func (set RoleSet) CheckLoginDuration(ttl time.Duration) ([]string, error) {
  	logins := make(map[string]bool)
  	var matchedTTL bool
  	for _, role := range set {
  		maxSessionTTL := role.GetOptions().MaxSessionTTL.Value()
  		if ttl <= maxSessionTTL && maxSessionTTL != 0 {
  			matchedTTL = true
  
  			for _, login := range role.GetLogins(Allow) {
  				logins[login] = true
  			}
  		}
  	}
  	if !matchedTTL {
  		return nil, trace.AccessDenied("this user cannot request a certificate for %v", ttl)
  	}
  	if len(logins) == 0 {
  		return nil, trace.AccessDenied("this user cannot create SSH sessions, has no allowed logins")
  	}
  	out := make([]string, 0, len(logins))
  	for login := range logins {
  		out = append(out, login)
  	}
  	return out, nil
  }
docs: // CheckLoginDuration checks if role set can login up to given duration and
  // returns a combined list of allowed logins.