Help text for --session-expiration-in-minutes should clarify UPST 60-min cap is server-enforced and non-overridable
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 669
- Forks
- 236
- Avg merge
- 1m
- Merged PRs (30d)
- 4
Description
Description
The oci session authenticate command's --session-expiration-in-minutes flag rejects values >60 with the message:
Session expiration cannot be longer than 60 minutes
The --help text for this flag states:
Valid values are from 5 to 60 for all realms.
However, this does not make clear that the 60-minute ceiling is a server-enforced constant that cannot be overridden by:
- The Identity Domain's
SessionExpirationTimesetting - An IAM policy
- Any tenancy-level configuration
Steps to Reproduce
oci session authenticate ... --session-expiration-in-minutes 240
# Output: Session expiration cannot be longer than 60 minutes
Expected Behaviour
The help text should explicitly state that the 60-minute cap is server-enforced, e.g.:
Maximum 60 minutes is enforced by the UPST service and cannot be overridden by tenancy policy. For long-lived automation, use API key auth.
This should also be documented in the Token-based Authentication for the CLI page.
Actual Behaviour
- The help text says "Valid values are from 5 to 60 for all realms" without explaining this is a hard server-side limit.
- The Token Authentication docs page mentions the 60-min ceiling in one sentence but does not clarify that neither Identity Domain session policies nor IAM policies can override it.
Impact
We spent ~20 minutes reading IAM docs and Identity Domain settings looking for a policy knob to extend session duration, before realizing there is no such override. Clear documentation would have avoided this entirely.
Suggested Fix
- Update the
--helptext for--session-expiration-in-minutesto explicitly state the 60-min cap is server-enforced and non-overridable. - Add a note to the Token-based Authentication docs page clarifying that no policy or configuration can extend the UPST TTL beyond 60 minutes, and recommend API key auth for long-lived automation.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the oci session authenticate --session-expiration-in-minutes help entry point and the linked Token-based Authentication for the CLI documentation page. Update both locations to explain that the 60-minute UPST cap is server-enforced and cannot be overridden, and verify the help output and documentation wording.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cli, cloud, documentation
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 74/100