Help text for --session-expiration-in-minutes should clarify UPST 60-min cap is server-enforced and non-overridable

[surapuramakhil]

Description

The oci session authenticate command's --session-expiration-in-minutes flag rejects values >60 with the message:

Session expiration cannot be longer than 60 minutes

The --help text for this flag states:

Valid values are from 5 to 60 for all realms.

However, this does not make clear that the 60-minute ceiling is a server-enforced constant that cannot be overridden by:

• The Identity Domain's SessionExpirationTime setting
• An IAM policy
• Any tenancy-level configuration

Steps to Reproduce

oci session authenticate ... --session-expiration-in-minutes 240
# Output: Session expiration cannot be longer than 60 minutes

Expected Behaviour

The help text should explicitly state that the 60-minute cap is server-enforced, e.g.:

Maximum 60 minutes is enforced by the UPST service and cannot be overridden by tenancy policy. For long-lived automation, use API key auth.

This should also be documented in the Token-based Authentication for the CLI page.

Actual Behaviour

• The help text says "Valid values are from 5 to 60 for all realms" without explaining this is a hard server-side limit.
• The Token Authentication docs page mentions the 60-min ceiling in one sentence but does not clarify that neither Identity Domain session policies nor IAM policies can override it.

Impact

We spent ~20 minutes reading IAM docs and Identity Domain settings looking for a policy knob to extend session duration, before realizing there is no such override. Clear documentation would have avoided this entirely.

Suggested Fix

1. Update the --help text for --session-expiration-in-minutes to explicitly state the 60-min cap is server-enforced and non-overridable.
2. Add a note to the Token-based Authentication docs page clarifying that no policy or configuration can extend the UPST TTL beyond 60 minutes, and recommend API key auth for long-lived automation.