We're also experiencing the same issue with Okta Verify. The same applies to Google Authenicator. In both cases this triggers of when you use the saml2aws for the first time from a new device. Okta then considers this to be a "suspicious" session and triggers the enhanced MFA routine resulting in the three digits being displayed on the screen. It works okay if you are working with a standar web browser session as you can read the acutal required number and press it on the Okta Verify or Google Auth app. It would be good to update the saml2aws code to read from the Okta TLS session feedback and scrap the number returned and present it in the console.

There is a pending merge request #793, would be great to have this feature soon.

Hopefully the patch will be applied soon, but as a workaround, you can set the environment variable DUMP_CONTENT to true as outlined in https://github.com/Versent/saml2aws#debugging-issues-with-idps. As the documentation warns, this will output authentication related information so don't copy and paste it into chat or tickets.

After authenticating, the response will contain a string like

_embedded":{"challenge":{"correctAnswer":99}}

Use that value to respond on your app.

As far as I can tell, you'll only need to do it once.