🤖🤖🤖 fix: collect all active Okta push factors and validate factor status (#31759)

[waterWang]

Description

Fixes #31759

This PR fixes two issues with the Okta authentication backend's MFA push factor handling:

1. Factor status validation
The mfaFactor struct now includes a Status field. Inactive factors (status != "ACTIVE") are skipped during factor enumeration, preventing spurious authentication failures when a user has suspended, inactive, or pending-activation factors.

2. Multiple push factor support
Instead of overwriting the pushFactor variable on each iteration (keeping only the last push factor), all active push factors are now collected into a pushFactors slice. If a push factor is rejected or times out, the next active push factor is tried automatically. This provides redundancy for users with multiple registered Okta Verify Push devices.

Changes

• builtin/credential/okta/backend.go:
  • Added Status field to mfaFactor struct
  • Filter factors by status == "ACTIVE" before use
  • Collect all active push factors into a slice instead of retaining only the last one
  • Fall through to the next push factor on REJECTED or TIMEOUT

Testing

The existing test file explicitly states: "This test does not exercise MFA however (which is an enterprise feature)". No test changes are included as the MFA flow requires an Okta enterprise environment with push factor enrollment.

[vercel]

Deployment failed with the following error:

The `vercel.json` schema validation failed with the following message: should NOT have additional property `public`

Learn More: https://vercel.com/docs/concepts/projects/project-configuration

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
vault-ui	Error		Jul 31, 2026 4:36pm

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

_{Have you signed the CLA already but the status is still pending? Recheck it.}

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

_{Have you signed the CLA already but the status is still pending? Recheck it.}

[waterWang]

ping

[heatherezell]

ping

Hello! We cannot accept any contributions without the Contributor License Agreement being signed. Once that's done, I can put your PRs in the queue for engineering evaluation. Thanks!