fix: Handle unknown Application signOnMode values gracefully (#511)

* feat: Handle unknown signOnMode values gracefully in Application models

Implement custom ApplicationJsonConverter to handle unknown, null, and
future signOnMode values without breaking SDK functionality. This enables
forward compatibility when Okta introduces new application types.

Key changes:
- Add ApplicationJsonConverter for polymorphic Application deserialization
- Route null signOnMode to ActiveDirectoryApplication
- Preserve unknown signOnMode values for round-trip fidelity
- Make sign_on_mode Optional to support null values
- Store original unknown values in _original_sign_on_mode attribute
- Use model_validate() to avoid recursion in from_dict()
- Use model_dump(mode='json') for proper enum serialization

The converter is only required in the base Application class as:
1. Unknown modes are architecturally impossible in subclasses
2. ApiClient.sanitize_for_serialization() handles enum conversion
3. Subclasses can only have known enum values (enforced by Pydantic)

This implementation matches the .NET SDK approach where unknown modes
are handled gracefully without spec changes.

Fixes: Unknown signOnMode values causing ValidationError

* - Removed MFA_AS_SERVICE sign on mode as we have added the support for handling unknown signOnModes.
- Updated application_json_converter.mustache for flake8 issues.

Author: BinoyOza-okta

docs/ActiveDirectoryApplication.md

@@ -0,0 +1,31 @@
+# ActiveDirectoryApplication
+
+Active Directory application for directory integrations. This application type has a null signOnMode.
+
+## Properties
+
+Name | Type | Description | Notes
+------------ | ------------- | ------------- | -------------
+**name** | **str** | Unique key for the Active Directory app definition. Always 'active_directory' for AD apps. | [optional] [readonly] 
+**settings** | [**ActiveDirectoryApplicationSettings**](ActiveDirectoryApplicationSettings.md) |  | [optional] 
+
+## Example
+
+```python
+from okta.models.active_directory_application import ActiveDirectoryApplication
+
+# TODO update the JSON string below
+json = "{}"
+# create an instance of ActiveDirectoryApplication from a JSON string
+active_directory_application_instance = ActiveDirectoryApplication.from_json(json)
+# print the JSON string representation of the object
+print(ActiveDirectoryApplication.to_json())
+
+# convert the object into a dict
+active_directory_application_dict = active_directory_application_instance.to_dict()
+# create an instance of ActiveDirectoryApplication from a dict
+active_directory_application_from_dict = ActiveDirectoryApplication.from_dict(active_directory_application_dict)
+```
+[[Back to Model list]](../README.md#documentation-for-models) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to README]](../README.md)
+
+

docs/ActiveDirectoryApplicationSettings.md

@@ -0,0 +1,36 @@
+# ActiveDirectoryApplicationSettings
+
+Settings for Active Directory applications
+
+## Properties
+
+Name | Type | Description | Notes
+------------ | ------------- | ------------- | -------------
+**em_opt_in_status** | **str** | The entitlement management opt-in status for the app | [optional] [readonly] 
+**identity_store_id** | **str** | Identifies an additional identity store app, if your app supports it. The `identityStoreId` value must be a valid identity store app ID. This identity store app must be created in the same org as your app. | [optional] 
+**implicit_assignment** | **bool** | Controls whether Okta automatically assigns users to the app based on the user's role or group membership. | [optional] 
+**inline_hook_id** | **str** | Identifier of an inline hook. Inline hooks are outbound calls from Okta to your own custom code, triggered at specific points in Okta process flows. They allow you to integrate custom functionality into those flows. See [Inline hooks](/openapi/okta-management/management/tag/InlineHook/). | [optional] 
+**notes** | [**ApplicationSettingsNotes**](ApplicationSettingsNotes.md) |  | [optional] 
+**notifications** | [**ApplicationSettingsNotifications**](ApplicationSettingsNotifications.md) |  | [optional] 
+**app** | [**ActiveDirectoryApplicationSettingsApplication**](ActiveDirectoryApplicationSettingsApplication.md) |  | [optional] 
+
+## Example
+
+```python
+from okta.models.active_directory_application_settings import ActiveDirectoryApplicationSettings
+
+# TODO update the JSON string below
+json = "{}"
+# create an instance of ActiveDirectoryApplicationSettings from a JSON string
+active_directory_application_settings_instance = ActiveDirectoryApplicationSettings.from_json(json)
+# print the JSON string representation of the object
+print(ActiveDirectoryApplicationSettings.to_json())
+
+# convert the object into a dict
+active_directory_application_settings_dict = active_directory_application_settings_instance.to_dict()
+# create an instance of ActiveDirectoryApplicationSettings from a dict
+active_directory_application_settings_from_dict = ActiveDirectoryApplicationSettings.from_dict(active_directory_application_settings_dict)
+```
+[[Back to Model list]](../README.md#documentation-for-models) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to README]](../README.md)
+
+

docs/ActiveDirectoryApplicationSettingsApplication.md

@@ -0,0 +1,37 @@
+# ActiveDirectoryApplicationSettingsApplication
+
+App-specific settings for Active Directory applications
+
+## Properties
+
+Name | Type | Description | Notes
+------------ | ------------- | ------------- | -------------
+**activation_email** | **str** | Email address to send activation emails | [optional] 
+**filter_groups_by_ou** | **bool** | Whether to filter groups by organizational unit | [optional] 
+**jit_groups_across_domains** | **bool** | Whether to enable just-in-time provisioning of groups across domains | [optional] 
+**login** | **str** | Login username for AD connection | [optional] 
+**naming_context** | **str** | The AD domain naming context (e.g., 'corp.local') | [optional] 
+**password** | **str** | Password for AD connection | [optional] 
+**scan_rate** | **int** | Rate at which to scan the AD directory | [optional] 
+**search_org_unit** | **str** | Organizational unit to search within | [optional] 
+
+## Example
+
+```python
+from okta.models.active_directory_application_settings_application import ActiveDirectoryApplicationSettingsApplication
+
+# TODO update the JSON string below
+json = "{}"
+# create an instance of ActiveDirectoryApplicationSettingsApplication from a JSON string
+active_directory_application_settings_application_instance = ActiveDirectoryApplicationSettingsApplication.from_json(json)
+# print the JSON string representation of the object
+print(ActiveDirectoryApplicationSettingsApplication.to_json())
+
+# convert the object into a dict
+active_directory_application_settings_application_dict = active_directory_application_settings_application_instance.to_dict()
+# create an instance of ActiveDirectoryApplicationSettingsApplication from a dict
+active_directory_application_settings_application_from_dict = ActiveDirectoryApplicationSettingsApplication.from_dict(active_directory_application_settings_application_dict)
+```
+[[Back to Model list]](../README.md#documentation-for-models) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to README]](../README.md)
+
+

docs/Application.md

@@ -15,7 +15,7 @@ Name | Type | Description | Notes
 **licensing** | [**ApplicationLicensing**](ApplicationLicensing.md) |  | [optional] 
 **orn** | **str** | The Okta resource name (ORN) for the current app instance | [optional] [readonly] 
 **profile** | **Dict[str, object]** | Contains any valid JSON schema for specifying properties that can be referenced from a request (only available to OAuth 2.0 client apps). For example, add an app manager contact email address or define an allowlist of groups that you can then reference using the Okta Expression Language `getFilteredGroups` function.  > **Notes:** > * `profile` isn't encrypted, so don't store sensitive data in it. > * `profile` doesn't limit the level of nesting in the JSON schema you created, but there is a practical size limit. Okta recommends a JSON schema size of 1 MB or less for best performance. | [optional] 
-**sign_on_mode** | [**ApplicationSignOnMode**](ApplicationSignOnMode.md) |  | 
+**sign_on_mode** | [**ApplicationSignOnMode**](ApplicationSignOnMode.md) |  | [optional] 
 **status** | [**ApplicationLifecycleStatus**](ApplicationLifecycleStatus.md) |  | [optional] 
 **universal_logout** | [**ApplicationUniversalLogout**](ApplicationUniversalLogout.md) |  | [optional] 
 **visibility** | [**ApplicationVisibility**](ApplicationVisibility.md) |  | [optional] 

docs/ApplicationSignOnMode.md

@@ -1,6 +1,6 @@
 # ApplicationSignOnMode
 
-Authentication mode for the app  | signOnMode | Description | | ---------- | ----------- | | AUTO_LOGIN | Secure Web Authentication (SWA) | | BASIC_AUTH | HTTP Basic Authentication with Okta Browser Plugin | | BOOKMARK | Just a bookmark (no-authentication) | | BROWSER_PLUGIN | Secure Web Authentication (SWA) with Okta Browser Plugin | | OPENID_CONNECT | Federated Authentication with OpenID Connect (OIDC) | | SAML_1_1 | Federated Authentication with SAML 1.1 WebSSO (not supported for custom apps) | | SAML_2_0 | Federated Authentication with SAML 2.0 WebSSO | | SECURE_PASSWORD_STORE | Secure Web Authentication (SWA) with POST (plugin not required) | | WS_FEDERATION | Federated Authentication with WS-Federation Passive Requestor Profile | | MFA_AS_SERVICE | Application to use Okta's MFA as a service for RDP |  Select the `signOnMode` for your custom app: 
+Authentication mode for the app  | signOnMode | Description | | ---------- | ----------- | | AUTO_LOGIN | Secure Web Authentication (SWA) | | BASIC_AUTH | HTTP Basic Authentication with Okta Browser Plugin | | BOOKMARK | Just a bookmark (no-authentication) | | BROWSER_PLUGIN | Secure Web Authentication (SWA) with Okta Browser Plugin | | OPENID_CONNECT | Federated Authentication with OpenID Connect (OIDC) | | SAML_1_1 | Federated Authentication with SAML 1.1 WebSSO (not supported for custom apps) | | SAML_2_0 | Federated Authentication with SAML 2.0 WebSSO | | SECURE_PASSWORD_STORE | Secure Web Authentication (SWA) with POST (plugin not required) | | WS_FEDERATION | Federated Authentication with WS-Federation Passive Requestor Profile |  Select the `signOnMode` for your custom app: 
 
 ## Properties
 

okta/__init__.py

@@ -191,6 +191,9 @@
     "ActionProviderPayloadType": "okta.models.action_provider_payload_type",
     "ActionProviderType": "okta.models.action_provider_type",
     "Actions": "okta.models.actions",
+    "ActiveDirectoryApplication": "okta.models.active_directory_application",
+    "ActiveDirectoryApplicationSettings": "okta.models.active_directory_application_settings",
+    "ActiveDirectoryApplicationSettingsApplication": "okta.models.active_directory_application_settings_application",
     "ActiveDirectoryGroupScope": "okta.models.active_directory_group_scope",
     "ActiveDirectoryGroupType": "okta.models.active_directory_group_type",
     "AddGroupRequest": "okta.models.add_group_request",

okta/models/__init__.py

@@ -36,6 +36,7 @@
         'AppConfigActiveDirectory',
     ],
     'application': [
+        'ActiveDirectoryApplication',
         'Application',
         'AutoLoginApplication',
         'BasicAuthApplication',
@@ -391,6 +392,9 @@
     "ActionProviderPayloadType": "okta.models.action_provider_payload_type",
     "ActionProviderType": "okta.models.action_provider_type",
     "Actions": "okta.models.actions",
+    "ActiveDirectoryApplication": "okta.models.active_directory_application",
+    "ActiveDirectoryApplicationSettings": "okta.models.active_directory_application_settings",
+    "ActiveDirectoryApplicationSettingsApplication": "okta.models.active_directory_application_settings_application",
     "ActiveDirectoryGroupScope": "okta.models.active_directory_group_scope",
     "ActiveDirectoryGroupType": "okta.models.active_directory_group_type",
     "AddGroupRequest": "okta.models.add_group_request",

okta/models/action_provider.py

@@ -68,7 +68,7 @@ class ActionProvider(BaseModel):
     @classmethod
     def get_discriminator_value(cls, obj: Dict[str, Any]) -> Optional[str]:
         """Returns the discriminator value (object type) of the data"""
-        discriminator_value = obj[cls.__discriminator_property_name]
+        discriminator_value = obj.get(cls.__discriminator_property_name)
         if discriminator_value:
             return cls.__discriminator_value_class_map.get(discriminator_value)
         else: