We have this issue with Ping (Forgerock) and the integrated browser in macos. It works fine in windows and linux. In GACS (now called "client app management", there is a setting for MacOS to allow Workspace to use an external browser to authenticate and that is how we got around this. It pops up. small frameless browser window with whatever the user has the default browser set to.