oracle / oracle/oci-cli

Help text for --session-expiration-in-minutes should clarify UPST 60-min cap is server-enforced and non-overridable

Open Beginner friendly
#1,109 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
669
Forks
236
Avg merge
1m
Merged PRs (30d)
4

Description

Description

The oci session authenticate command's --session-expiration-in-minutes flag rejects values >60 with the message:

Session expiration cannot be longer than 60 minutes

The --help text for this flag states:

Valid values are from 5 to 60 for all realms.

However, this does not make clear that the 60-minute ceiling is a server-enforced constant that cannot be overridden by:

  • The Identity Domain's SessionExpirationTime setting
  • An IAM policy
  • Any tenancy-level configuration

Steps to Reproduce

oci session authenticate ... --session-expiration-in-minutes 240
# Output: Session expiration cannot be longer than 60 minutes

Expected Behaviour

The help text should explicitly state that the 60-minute cap is server-enforced, e.g.:

Maximum 60 minutes is enforced by the UPST service and cannot be overridden by tenancy policy. For long-lived automation, use API key auth.

This should also be documented in the Token-based Authentication for the CLI page.

Actual Behaviour

  • The help text says "Valid values are from 5 to 60 for all realms" without explaining this is a hard server-side limit.
  • The Token Authentication docs page mentions the 60-min ceiling in one sentence but does not clarify that neither Identity Domain session policies nor IAM policies can override it.

Impact

We spent ~20 minutes reading IAM docs and Identity Domain settings looking for a policy knob to extend session duration, before realizing there is no such override. Clear documentation would have avoided this entirely.

Suggested Fix

  1. Update the --help text for --session-expiration-in-minutes to explicitly state the 60-min cap is server-enforced and non-overridable.
  2. Add a note to the Token-based Authentication docs page clarifying that no policy or configuration can extend the UPST TTL beyond 60 minutes, and recommend API key auth for long-lived automation.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the oci session authenticate --session-expiration-in-minutes help entry point and the linked Token-based Authentication for the CLI documentation page. Update both locations to explain that the 60-minute UPST cap is server-enforced and cannot be overridden, and verify the help output and documentation wording.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cli, cloud, documentation
Issue type
Documentation
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
74/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.