Fix mfa_enrollment for AUTHENTICATION_POLICY

Author: littleK0i

CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## [0.59.1] - 2025-10-25
+
+- Fixed issue with optional `mfa_enrollment` parameter for `AUTHENTICATION_POLICY`.
+
 ## [0.59.0] - 2025-10-24
 
 - All `AUTHENTICATION_POLICY` parameters are now optional.

snowddl/parser/authentication_policy.py

@@ -75,7 +75,7 @@ def process_authentication_policy(self, f: ParsedFile):
             full_name=SchemaObjectIdent(self.env_prefix, f.database, f.schema, f.name),
             authentication_methods=self.normalise_params_list(f.params.get("authentication_methods")),
             mfa_authentication_methods=self.normalise_params_list(f.params.get("mfa_authentication_methods")),
-            mfa_enrollment=f.params.get("mfa_enrollment").upper(),
+            mfa_enrollment=f.params.get("mfa_enrollment").upper() if f.params.get("mfa_enrollment") else None,
             mfa_policy=self.normalise_params_dict(f.params.get("mfa_policy")),
             client_types=self.normalise_params_list(f.params.get("client_types")),
             security_integrations=self.normalise_params_list(f.params.get("security_integrations")),

snowddl/version.py

@@ -1 +1 @@
-__version__ = "0.59.0"
+__version__ = "0.59.1"

test/_config/step2/db1/sc1/authentication_policy/aup003_aup1.yaml

@@ -1,2 +1 @@
 authentication_methods: [SAML, KEYPAIR]
-mfa_enrollment: REQUIRED_PASSWORD_ONLY

test/authentication_policy/aup003.py

@@ -20,7 +20,7 @@ def test_step2(helper):
     params = helper.desc_authentication_policy("db1", "sc1", "aup003_aup1")
 
     assert params["AUTHENTICATION_METHODS"]["value"] == "[SAML, KEYPAIR]"
-    assert params["MFA_ENROLLMENT"]["value"] == "REQUIRED_PASSWORD_ONLY"
+    assert params["MFA_ENROLLMENT"]["value"] == "REQUIRED_SNOWFLAKE_UI_PASSWORD_ONLY"
 
     assert "ALLOWED_METHODS=[ALL]" in params["MFA_POLICY"]["value"]