Listing factors fails if a claims_provider factor is encountered.

[kevinklitzke]

Currently if you try to list factors either using list_supported_factors or list_factors, if you encounter a claims_provider factor the API call fails with a "KeyError('claims_provider')" error.

No factors are returned and callers are unable to work around this without going directly to the underlying API calls. This is happening because the user factors model's haven't been updated to support / include or even ignore claims_provider factors that can be enabled in an Identity Engine Org.

[bretterer]

Can you confirm if this is still an issue for you in 2.9.0?

[cizo2000]

There is similar issue with Identity Engine and enabled FastPass for OKTA. SDK is not able to list factors because there is new factor type 'signed_nonce' added and related factor model is missing.

[csanders-git]

can confirm this issue appears on 2.9.3

factors, resp, err = await okta_client.list_supported_factors(user_id)

(Pdb) err
KeyError('claims_provider')

[waffleoffagus]

Confirming still an error on 2.9.3 as well with signed_nonce, looks like it was added to FactorType (https://github.com/okta/okta-sdk-python/blob/master/okta/models/factor_type.py#L37) just not added downstream yet (https://github.com/okta/okta-sdk-python/blob/master/okta/constants.py#L58).

Any updates for when this will potentially be fixed?

[ekm-detexian]

I can confirm this is still an issue on 2.9.6 with the Fastpass / signed_nonce type factor.

While there is a enum value for SIGNED_NONCE in FactorType here there is no entry in the Type to Model map in constants.py, nor is there a model for the type to map to.

[bryanapellanes-okta]

@ekm-detexian Thanks for re-confirming and thank you for your patience. I've entered an internal ticket for prioritization and tracking.

OKTA-732840

[bryanapellanes-okta]

@cizo2000 @csanders-git @waffleoffagus See previous comment, fyi.

[BinoyOza-okta]

Hi,

Thank you for reporting this issue regarding the KeyError('claims_provider') when listing factors.

Investigation Summary

We have reviewed this issue. It appears this was raised against an older version of the SDK. We have recently released a major new version, SDK v3.0.0, which involves a significant architectural change (migration to an OpenAPI-generated SDK). This new version includes updated models and deserialization logic that should correctly handle all factor types supported by the Identity Engine, resolving the KeyError.

Action Required: Please Test with SDK v3.0.0

Could you please upgrade to the latest version (v3.0.0) and adjust your implementation to match the new architecture?

How to upgrade:

pip install okta

Test the same functionality:

In v3.0.0, you can list factors using the client method.

Please verify:

1. Does the code now run without raising KeyError('claims_provider')?
2. Are you able to see the claims_provider factor (or at least iterate past it) in the returned list?

Next Steps

Please let us know if the issue is resolved in v3.0.0 or if you encounter difficulties during the migration.

If we don't receive a response within one week, we will close this issue. You can always reopen it if needed.

Thank you for your detailed report and patience!

---

Best,
Binoy

[cizo2000]

Hello Binoy,

issue is still there for "signed_nonce" factors. When obtaining list for factors, it fails to de-serialize model for this type. Following method in .from_dict() class method in generated code will not get object_type and all fails with Value Error:

object_type = cls.get_discriminator_value(obj)

It uses class map variable:

    __discriminator_value_class_map: ClassVar[Dict[str, str]] = {
        "call": "CallUserFactor",
        "email": "EmailUserFactor",
        "hotp": "CustomHotpUserFactor",
        "push": "PushUserFactor",
        "question": "SecurityQuestionUserFactor",
        "sms": "SmsUserFactor",
        "token": "TokenUserFactor",
        "token:hardware": "HardwareUserFactor",
        "token:hotp": "CustomHotpUserFactor",
        "token:software:totp": "TotpUserFactor",
        "u2f": "U2fUserFactor",
        "web": "WebUserFactor",
        "webauthn": "WebAuthnUserFactor",
    }

As you can see it is missing related class.
This is still also issue related to "claims_provider" type as well.

Thanks

[BinoyOza-okta]

Hi @cizo2000,

Thank you for reporting this issue regarding the missing signed_nonce field.

Investigation Summary

We have reviewed this issue. It appears this field was missing from the model definitions in the older version of the SDK, so it wasn't available when inspecting User Factor or verification responses, even if the API returned it.

We recently released SDK v3.1.0, which is fully generated from the Okta OpenAPI specification. This new architectural approach ensures that all properties returned by the API—including the signedNonce property (mapped to signed_nonce in Python)—are explicitly defined in the models and accurately deserialized.

Action Required: Please Test with SDK v3.1.0

Could you please upgrade to the latest version (v3.1.0) and verify if the signed_nonce is now accessible?

How to upgrade:

pip install okta --upgrade

Test the functionality:

In v3.1.0, you can access the property on the verification response or factor object, depending on the operation.

Please verify:

1. Can you access the signed_nonce property when returning factor/verification data?

Next Steps

Please let us know if the issue is resolved in v3.1.0 or if the field is still missing for you.

If we don't receive a response within one week, we will close this issue. You can always reopen it if needed.

Thank you for your patience and for helping improve the SDK!

---

Best,
Binoy

[cizo2000]

Hello @BinoyOza-okta

I have tested simple call for list_factors() for my user. Issue is still there in okta/models/user_factor.py in from_dict().
OpenApi spec change is still not reflected in generated code.

Factor type is:

UserFactor: {"id": "XXXXXXXX", "factorType": "signed_nonce", "provider": "OKTA", "vendorName": "OKTA", "status": "ACTIVE",...}

Error:

Discriminator property name: factorType, mapping: {"call": "UserFactorCall", "email": "UserFactorEmail", "push": "UserFactorPush", "question": "UserFactorSecurityQuestion", "sms": "UserFactorSMS", "token": "UserFactorToken", "token:hardware": "UserFactorTokenHardware", "token:hotp": "UserFactorTokenHOTP", "token:software:totp": "UserFactorTokenSoftwareTOTP", "u2f": "UserFactorU2F", "web": "UserFactorWeb", "webauthn": "UserFactorWebAuthn"}

So still model for signed_nonce is missing

Thanks
Cizo