OpenConnect-macOS

OpenConnect-macOS icon

GlobalProtect VPN with SAML sign-in, from your Mac’s menu bar.

openconnect speaks GlobalProtect, but its command line can’t show the web page a SAML sign-in (Okta, Azure AD, …) needs. This app can: choose Connect, sign in in its window — usually just approving a push, since the session is remembered — and it starts openconnect with the result. A little tunnel in the menu bar shows the state: dots while connecting or reconnecting, a line through it when you’re on.

Features

  • Menu-bar only — no Dock icon, no main window; just a tunnel icon.
  • SAML sign-in in a built-in web view, with the session kept between connects.
  • Touch ID approves each connect: openconnect needs root, and the app runs it through plain sudo. No privileged helper and no sudoers rule.
  • Survives the app — the tunnel keeps running if the app quits unexpectedly, and the app picks it up again when it starts.
  • Split-tunnel extras — add routes the gateway doesn’t push, and send your company’s domains to its DNS servers.
  • Checks before signing in — optionally that you’re leaving from the country your sign-in expects, and that no stale route from a crashed session blocks the gateway.

Download

⬇ Download OpenConnect-macOS 1.0

macOS 14 or later. Free. Needs openconnect, from MacPorts (sudo port install openconnect) or Homebrew (brew install openconnect).

Not affiliated with Palo Alto Networks or the OpenConnect project.

First launch

The app is signed but not notarized by Apple (it’s a personal build, not from the App Store), so the first launch takes one extra step:

  1. Unzip and drag OpenConnect-macOS.app into Applications.
  2. Double-click it — macOS will refuse the first time. Click Done.
  3. Open System Settings → Privacy & Security, and next to the note about OpenConnect-macOS, click Open Anyway.

You only do this once. Or, from Terminal:

xattr -dr com.apple.quarantine /Applications/OpenConnect-macOS.app

Preferences opens on the first launch: enter your VPN gateway and choose Connect. To approve connects with Touch ID rather than your password, enable it for sudo once:

sed 's/^#auth/auth/' /etc/pam.d/sudo_local.template | sudo tee /etc/pam.d/sudo_local