To install a Palo Alto Networks GlobalProtect VPN client on Debian Bookworm, the following should in principle be sufficient

apt install openconnect network-manager-openconnect network-manager-openconnect-gnome


However, this did not work with KDE/Plasma. I then tried logging in with Gnome as Desktop Environment and I got once shown the SSO (with MFA) web interface inside the the Openconnect window, but without further success, i.e. without establishing the VPN connection.

Then, I downloaded from the assets at https://github.com/yuezk/GlobalProtect-openconnect the most recent amd64 deb:
https://github.com/yuezk/GlobalProtect-openconnect/releases/download/v2.3.9/globalprotect-openconnect_2.3.9-1_amd64.deb
and installed a missing dependency using apt install libgdk-pixbuf2.0-0 and then installed the downloaded deb.

I tried the graphical client (trial version working for 10 days only), but that did anyway not work. However, then the command line version finally worked:
sudo -E gpclient connect vpn.hi.is
It opens (probably using libwebkit2gtk that Debian had installed) a graphical Window for the SSO/MFA. Note that I had to re-run that command a couple of times until it finally worked.