Description

What happened:
After logging into teleport with a role that has a max_session_ttl set to 8hr, I was able to generate a certificate that would be valid up to 30hrs.

What you expected to happen:
Expected behavior is that the ability to generate an identity cert should be limited to the max_session_ttl for the roles assumed by the user.

Reproduction Steps

As minimally and precisely as possible, describe step-by-step how to reproduce the problem.

1. Create user with only a single role
2. Set max_session_ttl to 8hr0m0s
3. Export an identity cert that's longer than 8hrs with tsh login --auth=sso --out=test --ttl=1800

Server Details

• Teleport version (run teleport version): 6.2.5

Client Details

• Tsh version (tsh version): 6.2.5