Deploy Zscaler Client Connector app for macOS via Intune

Platforms

macOS

Products

IntuneZscaler

Result

Zscaler Client Connector installs silently on managed Macs with your domain and cloud preconfigured

Overview

Turn the Zscaler Client Connector .app into a signed and notarized .pkg with your own install options, then deploy it to Macs as an Intune line-of-business app.

Zscaler Client Connector gives users all the benefits of the Zscaler service for internet traffic, as well as granular, policy-based access to internal resources, from a single app. The Zscaler app for macOS comes as an application bundle (.app) that can be converted into a package (.pkg) with a post-install script that sets the install options for your environment, see Customizing Zscaler Client Connector with Install Options for macOS.

The Apple flat package (.pkg) format is the standard app installer on macOS, similar to an MSI on Windows. PKG files distributed by MDM servers (Intune, Jamf etc.) as line-of-business (LOB) apps must be signed with a trusted certificate (Developer ID Installer) because of Gatekeeper. Gatekeeper protects users from malicious software by checking apps distributed outside the Mac App Store for a Developer ID certificate. See Apple's Developer ID page for the signing requirements.

Mac apps, installer packages (.pkg) and kernel extensions signed with Developer ID must also be notarized by Apple to run by default on macOS Catalina 10.15 or later. Notarization gives users more confidence that Apple has checked your Developer ID-signed software for malicious components, see Notarizing macOS software before distribution.

Prerequisites

Before you start, check that you have the following.

Configuration

With the prerequisites in place, get the certificate first, then build, sign, notarize and deploy the package.

Get a Developer ID certificate

The Developer ID Installer certificate signs your app's installer package (.pkg) for distribution outside the Mac App Store.

Before you create another Developer ID certificate, note that you can't delete Developer ID certificates from the Apple Developer portal (only from your local Keychain). One certificate can sign many apps, and it's important to back up the private keys so you don't lose access to the certificate. The number of development and distribution certificates you can create is limited.

There are several ways to request a new Developer ID Installer certificate in the Apple Developer Program. I used Xcode on my Mac, signed in with my Apple Developer account:

Any method works, as long as you get the Developer ID Installer certificate (one certificate is enough for signing), for example in the developer portal:

• https://developer.apple.com/account/resources/certificates/list

Note: If you create several certificates, you can't delete them later from the Apple Developer portal, and you can create up to five Developer ID Installer certificates, see Certificate types.

The certificate must be on the Mac where you build the package. If needed, export it to a .p12 file from Keychain Access, see Export signing certificates.

Create and sign the PKG file

On a Mac you don't need third-party software to build a package. The Zscaler team documents the steps with the pkgbuild command-line tool in their Intune deployment guide.

Instead of repeating it, I show Jamf Composer, a GUI tool that makes packaging and signing almost a drag-and-drop experience and converts the .app into a .pkg. In my video at the end of this post I used:

• Mac device with Jamf Composer v10.38.0 installed
• Apple Developer certificate (.p12) imported into the Keychain
• Zscaler-osx-3.6.1.19-installer (.app) for macOS, downloaded from the Client Connector App Store
• Postinstall script with the install options for the Zscaler app, see install options for macOS

My postinstall script (replace the domain, cloud name and app version with yours):

#!/bin/sh
## postinstall
sudo sh /private/var/tmp/Zscaler-osx-3.6.1.19-installer.app/Contents/MacOS/installbuilder.sh --hideAppUIOnLaunch 1 --mode unattended --unattendedmodeui none --userDomain hmaslowski.com/ --cloudName zscalertwo
exit 0      ## Success

The video doesn't show it, but there is also an Info.plist file where you set the bundle identifier and version of the package. These matter for correct detection of the app by the MDM server after installation:

• App bundle ID (CFBundleIdentifier)
• App version (CFBundleShortVersionString)

Notarize the PKG file

Notarization gives users confidence that Apple has checked the software on their machines for malicious components. Two command-line tools could submit a PKG file to Apple for notarization:

• notarytool (new, requires Xcode 14 or later for notarization)
• altool (old, no longer accepted for notarization since November 2023)

With Xcode 14 or later installed, run xcrun to find notarytool:

xcrun --find notarytool

Output:

/Applications/Xcode.app/Contents/Developer/usr/bin/notarytool

Create an app-specific password for your Apple Account (formerly Apple ID) on the Apple Account page:

Copy the password and run this command in Terminal:

xcrun notarytool store-credentials --apple-id "developer@domain.com" --team-id "ABCD123456"

Replace the Apple Account and Team ID with your own. The command asks for a profile name and the app-specific password:

This process stores your credentials securely in the Keychain. You reference these credentials later using a profile name.

Profile name:
notary-hmaslowski
App-specific password for developer@domain.com:
Validating your credentials...
Success. Credentials validated.
Credentials saved to Keychain.
To use them, specify `--keychain-profile "notary-hmaslowski"`

Note the profile name: notarytool uses it with the –keychain-profile parameter to read the credentials.

Now notarize the Zscaler PKG file with this command:

xcrun notarytool submit /<PATH>/Zscaler-osx-3.6.1.19-installer.pkg --keychain-profile "notary-hmaslowski"

Replace <PATH> with the folder of your package and notary-hmaslowski with your profile name. Output:

Conducting pre-submission checks for Zscaler-osx-3.6.1.19-installer.pkg and initiating connection to the Apple notary service...
Submission ID received
  id: e62a22ee-203d-4b61-ba60-cdf2bcf6207f
Successfully uploaded file
  id: e62a22ee-203d-4b61-ba60-cdf2bcf6207f
  path: /Users/hmaslowski/Desktop/Zscaler-osx-3.6.1.19-installer.pkg

Staple the PKG file (optional)

Stapler attaches the notarization ticket to the PKG file, so an offline Mac can still check that it is notarized:

xcrun stapler staple /<PATH>/Zscaler-osx-3.6.1.19-installer.pkg

Output:

Processing: /Users/hmaslowski/Desktop/Zscaler-osx-3.6.1.19-installer.pkg
Processing: /Users/hmaslowski/Desktop/Zscaler-osx-3.6.1.19-installer.pkg
The staple and validate action worked!

Verify the package file

Check in Terminal that the package (.pkg) is correctly signed and notarized:

pkgutil --check-signature /<PATH>/Zscaler-osx-3.6.1.19-installer.pkg

Expected output:

Status: signed by a developer certificate issued by Apple for distribution
Notarization: trusted by the Apple notary service

Deploy the PKG file with Intune

Intune can deploy package (.pkg) files as line-of-business (LOB) apps without the Intune App Wrapping Tool for macOS, so there is NO need to convert the PKG file to the .intunemac format.

Zscaler-osx-3.6.1.19-installer.pkg

App bundle ID (CFBundleIdentifier): com.zscaler.Zscaler

App version (CFBundleShortVersionString): 3.6.1.19

Result

After assignment, Intune installs the package on the Macs.

The Zscaler app installed successfully:

My video shows the whole process from start to finish: converting the .app into a .pkg with the postinstall script in Jamf Composer, signing it, and the Zscaler Client Connector app on the Mac after installation.