tsh db ls returns AccessDeniedError in trusted cluster setup

[smallinsky]

Description

tsh db ls returns the trace.AccessDeniedError error in case of trusted cluster setup.

ERROR REPORT:
Original Error: *trace.AccessDeniedError access denied to perform action "read" on "role"
Stack Trace:
	/Users/jnyckowski/projects/teleport/api/client/client.go:1303 github.com/gravitational/teleport/api/client.(*Client).GetRole
	/Users/jnyckowski/projects/teleport/lib/auth/httpfallback.go:57 github.com/gravitational/teleport/lib/auth.(*Client).GetRole
	/Users/jnyckowski/projects/teleport/lib/services/role.go:804 github.com/gravitational/teleport/lib/services.FetchRoleList
	/Users/jnyckowski/projects/teleport/lib/services/role.go:818 github.com/gravitational/teleport/lib/services.FetchRoles
	/Users/jnyckowski/projects/teleport/tool/tsh/db.go:72 main.onListDatabases
	/Users/jnyckowski/projects/teleport/tool/tsh/tsh.go:779 main.Run
	/Users/jnyckowski/projects/teleport/tool/tsh/tsh.go:337 main.main
	/Users/jnyckowski/go/go1.18/src/runtime/proc.go:250 runtime.main
	/Users/jnyckowski/go/go1.18/src/runtime/asm_arm64.s:1259 runtime.goexit
User Message: access denied to perform action "read" on "role"

Reproduction Steps

1. Setup trusted env
2. Log into leaf cluster
3. Preform tsh db ls

[Tener]

Looks like an issue with permissions, definitely something to fix though. My guess is that a trusted cluster assigns a role without visibility into role definition. I'd say the fix is to do graceful degradation.