When users attempt to authenticate to the Palo Alto GlobalProtect VPN client using Okta, the embedded browser window that appears for credentials is blank or empty.

Users may discover that resizing or maximizing the window forces the content to appear, allowing them to complete the sign-in process.

• Palo Alto GlobalProtect VPN Client (Versions 6.2.7, 6.3.2, 6.1.5, 6.0.12 and earlier)
• Windows 11

This behavior is caused by a recent set of Microsoft Windows updates (KB5051987/KB5051989), which impacts the GlobalProtect embedded browser's ability to reliably render web content (GPC-22542), which impacts the Okta sign-in widget.

Permanent Fix (Recommended) Palo Alto Networks has released a fix for this issue in the 6.2.x release train.

1. Upgrade the GlobalProtect client to version 6.2.8 or later.

NOTE: Fixes for other release trains (6.0.13, 6.1.6, and 6.3.3) are pending release. Check the GlobalProtect release notes for availability.

Workaround

If an upgrade is not immediately possible, users can utilize one of the following workarounds:

• Resize the Window:

  1. When the blank window appears, click the Maximize (square) icon in the top right corner.

  2. Alternatively, click and drag the corner of the window to resize it manually.

  3. The Okta sign-in widget will trigger a re-render and appear.

• Uninstall Windows Updates:

  1. If organization security policies allow, uninstall the affected Windows updates (KB5051987 or KB5051989).

  2. Navigate to Settings > Windows Update > Update History > Uninstall Updates.

• Contact Palo Alto Support for further troubleshooting.

Related References

• Palo Alto Knowledge Base: GlobalProtect Embedded Browser opens but page displayed is blank (SAML)