fix: Handle unknown Application signOnMode values gracefully

This commit introduces a post-processing mechanism to handle Application
objects with signOnMode values that are not defined in the ApplicationSignOnMode
enum, preventing deserialization errors when new sign-on modes are introduced
by Okta.

Changes:
- Added post_process_application.py script with custom deserialization logic
- Implements x-post-process-function vendor extension support
- Updated api.yaml to reference post-processing for Application schema
- Modified model_generic.mustache to invoke post-processing when defined
- Added OTHER enum value to ApplicationSignOnMode for unknown modes

The solution uses OpenAPI Generator's vendor extension mechanism (x-post-process-function)
to apply custom deserialization logic specifically to the Application model without
affecting other models in the SDK.

When an Application response contains an unknown signOnMode:
1. Discriminator resolution falls back to 'OTHER' mapping
2. Post-processing preserves the original signOnMode value
3. Application object is returned with the actual value from API response
4. SDK remains forward-compatible with new Okta sign-on modes

This prevents breaking changes when Okta introduces new application types
like MFA_AS_SERVICE while maintaining type safety for known values.

Fixes: Deserialization errors for applications with unknown signOnMode values

Author: BinoyOza-okta

docs/ApplicationSignOnMode.md

@@ -1,6 +1,6 @@
 # ApplicationSignOnMode
 
-Authentication mode for the app  | signOnMode | Description | | ---------- | ----------- | | AUTO_LOGIN | Secure Web Authentication (SWA) | | BASIC_AUTH | HTTP Basic Authentication with Okta Browser Plugin | | BOOKMARK | Just a bookmark (no-authentication) | | BROWSER_PLUGIN | Secure Web Authentication (SWA) with Okta Browser Plugin | | OPENID_CONNECT | Federated Authentication with OpenID Connect (OIDC) | | SAML_1_1 | Federated Authentication with SAML 1.1 WebSSO (not supported for custom apps) | | SAML_2_0 | Federated Authentication with SAML 2.0 WebSSO | | SECURE_PASSWORD_STORE | Secure Web Authentication (SWA) with POST (plugin not required) | | WS_FEDERATION | Federated Authentication with WS-Federation Passive Requestor Profile | | MFA_AS_SERVICE | Application to use Okta's MFA as a service for RDP |  Select the `signOnMode` for your custom app: 
+Authentication mode for the app  | signOnMode | Description | | ---------- | ----------- | | AUTO_LOGIN | Secure Web Authentication (SWA) | | BASIC_AUTH | HTTP Basic Authentication with Okta Browser Plugin | | BOOKMARK | Just a bookmark (no-authentication) | | BROWSER_PLUGIN | Secure Web Authentication (SWA) with Okta Browser Plugin | | OPENID_CONNECT | Federated Authentication with OpenID Connect (OIDC) | | SAML_1_1 | Federated Authentication with SAML 1.1 WebSSO (not supported for custom apps) | | SAML_2_0 | Federated Authentication with SAML 2.0 WebSSO | | SECURE_PASSWORD_STORE | Secure Web Authentication (SWA) with POST (plugin not required) | | WS_FEDERATION | Federated Authentication with WS-Federation Passive Requestor Profile | | MFA_AS_SERVICE | Application to use Okta's MFA as a service for RDP | | OTHER | Unknown Sign on mode |  Select the `signOnMode` for your custom app: 
 
 ## Properties
 

okta/models/__init__.py

@@ -41,6 +41,7 @@
         'BasicAuthApplication',
         'BookmarkApplication',
         'BrowserPluginApplication',
+        'Application'
         'OpenIdConnectApplication',
         'Saml11Application',
         'SamlApplication',

okta/models/action_provider.py

@@ -70,7 +70,11 @@ def get_discriminator_value(cls, obj: Dict[str, Any]) -> Optional[str]:
         """Returns the discriminator value (object type) of the data"""
         discriminator_value = obj[cls.__discriminator_property_name]
         if discriminator_value:
-            return cls.__discriminator_value_class_map.get(discriminator_value)
+            mapped_class = cls.__discriminator_value_class_map.get(discriminator_value)
+            if mapped_class:
+                return mapped_class
+            # If not in mapping, return base class (will be handled by post-processing for Application)
+            return "ActionProvider"
         else:
             return None
 

okta/models/app_config.py

@@ -63,7 +63,11 @@ def get_discriminator_value(cls, obj: Dict[str, Any]) -> Optional[str]:
         """Returns the discriminator value (object type) of the data"""
         discriminator_value = obj[cls.__discriminator_property_name]
         if discriminator_value:
-            return cls.__discriminator_value_class_map.get(discriminator_value)
+            mapped_class = cls.__discriminator_value_class_map.get(discriminator_value)
+            if mapped_class:
+                return mapped_class
+            # If not in mapping, return base class (will be handled by post-processing for Application)
+            return "AppConfig"
         else:
             return None
 

okta/models/application.py

@@ -52,6 +52,7 @@
     from okta.models.browser_plugin_application import BrowserPluginApplication
     from okta.models.application import Application
     from okta.models.open_id_connect_application import OpenIdConnectApplication
+    from okta.models.application import Application
     from okta.models.saml11_application import Saml11Application
     from okta.models.saml_application import SamlApplication
     from okta.models.secure_password_store_application import (
@@ -108,6 +109,8 @@ class Application(BaseModel):   # noqa: F811
     visibility: Optional[ApplicationVisibility] = None
     embedded: Optional[ApplicationEmbedded] = Field(default=None, alias="_embedded")
     links: Optional[ApplicationLinks] = Field(default=None, alias="_links")
+    # Store the original sign-on mode value when it's not in the enum
+    _original_sign_on_mode: Optional[str] = None
     __properties: ClassVar[List[str]] = [
         "accessibility",
         "created",
@@ -212,6 +215,7 @@ def features_validate_enum(cls, value):
         "BROWSER_PLUGIN": "BrowserPluginApplication",
         "MFA_AS_SERVICE": "Application",
         "OPENID_CONNECT": "OpenIdConnectApplication",
+        "OTHER": "Application",
         "SAML_1_1": "Saml11Application",
         "SAML_2_0": "SamlApplication",
         "SECURE_PASSWORD_STORE": "SecurePasswordStoreApplication",
@@ -223,7 +227,11 @@ def get_discriminator_value(cls, obj: Dict[str, Any]) -> Optional[str]:
         """Returns the discriminator value (object type) of the data"""
         discriminator_value = obj[cls.__discriminator_property_name]
         if discriminator_value:
-            return cls.__discriminator_value_class_map.get(discriminator_value)
+            mapped_class = cls.__discriminator_value_class_map.get(discriminator_value)
+            if mapped_class:
+                return mapped_class
+            # If not in mapping, return base class (will be handled by post-processing for Application)
+            return "Application"
         else:
             return None
 
@@ -245,6 +253,7 @@ def from_json(cls, json_str: str) -> Optional[
             BrowserPluginApplication,
             Application,
             OpenIdConnectApplication,
+            Application,
             Saml11Application,
             SamlApplication,
             SecurePasswordStoreApplication,
@@ -333,6 +342,9 @@ def to_dict(self) -> Dict[str, Any]:
             else:
                 _dict["_links"] = self.links
 
+        # If we have an original sign-on mode (was unknown), return it instead of OTHER
+        if self._original_sign_on_mode:
+            _dict["signOnMode"] = self._original_sign_on_mode
         return _dict
 
     @classmethod
@@ -344,6 +356,7 @@ def from_dict(cls, obj: Dict[str, Any]) -> Optional[
             BrowserPluginApplication,
             Application,
             OpenIdConnectApplication,
+            Application,
             Saml11Application,
             SamlApplication,
             SecurePasswordStoreApplication,
@@ -378,13 +391,32 @@ def from_dict(cls, obj: Dict[str, Any]) -> Optional[
         if object_type == "Application":
             # Check if the discriminator maps to the same class to avoid infinite recursion
             if object_type == cls.__name__:
+                # Handle unknown sign-on modes
+                original_discriminator = obj.get(cls.__discriminator_property_name)
+                if (
+                    original_discriminator
+                    and original_discriminator
+                    not in cls.__discriminator_value_class_map
+                ):
+                    # Store the original value and replace with OTHER
+                    obj_copy = obj.copy()
+                    # Note: This assumes an OTHER value exists in the discriminator enum
+                    obj_copy[cls.__discriminator_property_name] = "OTHER"
+                    instance = cls.model_validate(obj_copy)
+                    instance._original_sign_on_mode = original_discriminator
+                    return instance
                 return cls.model_validate(obj)
             return models.Application.from_dict(obj)
         if object_type == "OpenIdConnectApplication":
             # Check if the discriminator maps to the same class to avoid infinite recursion
             if object_type == cls.__name__:
                 return cls.model_validate(obj)
             return models.OpenIdConnectApplication.from_dict(obj)
+        if object_type == "Application":
+            # Check if the discriminator maps to the same class to avoid infinite recursion
+            if object_type == cls.__name__:
+                return cls.model_validate(obj)
+            return models.Application.from_dict(obj)
         if object_type == "Saml11Application":
             # Check if the discriminator maps to the same class to avoid infinite recursion
             if object_type == cls.__name__:

okta/models/application_feature.py

@@ -78,7 +78,11 @@ def get_discriminator_value(cls, obj: Dict[str, Any]) -> Optional[str]:
         """Returns the discriminator value (object type) of the data"""
         discriminator_value = obj[cls.__discriminator_property_name]
         if discriminator_value:
-            return cls.__discriminator_value_class_map.get(discriminator_value)
+            mapped_class = cls.__discriminator_value_class_map.get(discriminator_value)
+            if mapped_class:
+                return mapped_class
+            # If not in mapping, return base class (will be handled by post-processing for Application)
+            return "ApplicationFeature"
         else:
             return None
 

okta/models/application_sign_on_mode.py

@@ -53,6 +53,7 @@ class ApplicationSignOnMode(str, Enum):
     SECURE_PASSWORD_STORE = "SECURE_PASSWORD_STORE"
     WS_FEDERATION = "WS_FEDERATION"
     MFA_AS_SERVICE = "MFA_AS_SERVICE"
+    OTHER = "OTHER"
 
     @classmethod
     def from_json(cls, json_str: str) -> Self:

okta/models/authenticator_base.py

@@ -129,7 +129,11 @@ def get_discriminator_value(cls, obj: Dict[str, Any]) -> Optional[str]:
         """Returns the discriminator value (object type) of the data"""
         discriminator_value = obj[cls.__discriminator_property_name]
         if discriminator_value:
-            return cls.__discriminator_value_class_map.get(discriminator_value)
+            mapped_class = cls.__discriminator_value_class_map.get(discriminator_value)
+            if mapped_class:
+                return mapped_class
+            # If not in mapping, return base class (will be handled by post-processing for Application)
+            return "AuthenticatorBase"
         else:
             return None
 

okta/models/authenticator_method_base.py

@@ -93,7 +93,11 @@ def get_discriminator_value(cls, obj: Dict[str, Any]) -> Optional[str]:
         """Returns the discriminator value (object type) of the data"""
         discriminator_value = obj[cls.__discriminator_property_name]
         if discriminator_value:
-            return cls.__discriminator_value_class_map.get(discriminator_value)
+            mapped_class = cls.__discriminator_value_class_map.get(discriminator_value)
+            if mapped_class:
+                return mapped_class
+            # If not in mapping, return base class (will be handled by post-processing for Application)
+            return "AuthenticatorMethodBase"
         else:
             return None
 

okta/models/authenticator_method_with_verifiable_properties.py

@@ -97,7 +97,11 @@ def get_discriminator_value(cls, obj: Dict[str, Any]) -> Optional[str]:
         """Returns the discriminator value (object type) of the data"""
         discriminator_value = obj[cls.__discriminator_property_name]
         if discriminator_value:
-            return cls.__discriminator_value_class_map.get(discriminator_value)
+            mapped_class = cls.__discriminator_value_class_map.get(discriminator_value)
+            if mapped_class:
+                return mapped_class
+            # If not in mapping, return base class (will be handled by post-processing for Application)
+            return "AuthenticatorMethodWithVerifiableProperties"
         else:
             return None