list_policies(type="MFA_ENROLL") fails on smart_card_idp: enum missing from AuthenticatorEnrollmentPolicyAuthenticatorType

[jackvaughanjr]

New issue?

• I have reviewed the Existing Issues and confirm this is not an existing issue.

Bug

list_policies(type="MFA_ENROLL") raises a pydantic_core.ValidationError and aborts the entire response when any MFA enrollment policy references the smart_card_idp authenticator. The SDK's AuthenticatorEnrollmentPolicyAuthenticatorType enum doesn't include it, even though the SDK's own AuthenticatorKeyEnum recognizes smart_card_idp as a valid authenticator key elsewhere.

Expected behavior

list_policies(type="MFA_ENROLL") returns all MFA enrollment policies in the tenant, including ones that reference smart-card (PIV/CAC) authenticators.

Observed behavior

Reproduced consistently (not a flake) against a live Okta for Government (FedRAMP) tenant, on okta-mcp-server v1.1.4 / okta SDK 3.4.4 (current main as of this report). This survives the 3.4.4 bump from #89, which fixed a related but distinct AccessPolicyConstraint.methods/.types case-sensitivity bug on access-policy rules; that fix doesn't touch this enum.

1 validation error for AuthenticatorEnrollmentPolicyAuthenticatorSettings
key
  Input should be 'custom_app', 'custom_otp', 'duo', 'external_idp', 'google_otp', 'okta_email', 'okta_password', 'okta_verify', 'onprem_mfa', 'phone_number', 'rsa_token', 'security_question', 'symantec_vip', 'webauthn' or 'yubikey_token' [type=enum, input_value='smart_card_idp', input_type=str]
    For further information visit https://errors.pydantic.dev/2.11/v/enum

okta.models.authenticator_key_enum.AuthenticatorKeyEnum (used for the Authenticators resource itself) already has:

SMART_CARD_IDP = "smart_card_idp"

but okta.models.authenticator_enrollment_policy_authenticator_type.AuthenticatorEnrollmentPolicyAuthenticatorType (used for the key field on AuthenticatorEnrollmentPolicyAuthenticatorSettings, i.e. MFA_ENROLL policy authenticator settings) does not. It's a second, hand-kept enum that has drifted from the first. Smart-card/PIV-CAC authenticators are common in Okta for Government tenants (government/CAC-oriented use cases) and rare in commercial Okta, which is presumably why this was missed.

Additional information

We've applied a local workaround (relax AuthenticatorEnrollmentPolicyAuthenticatorSettings.key to a plain Optional[str] and force a schema rebuild, mirroring the existing LogSecurityContext.user_behaviors workaround in system_logs.py) and confirmed it resolves the issue against our tenant, including for previously-valid keys. A narrower fix would be adding smart_card_idp as a member of AuthenticatorEnrollmentPolicyAuthenticatorType directly, but that enum still risks drifting from AuthenticatorKeyEnum again. Opened as #102, using the broader relaxation.