[keycloak-user] ADFS SAML Identity provider using Keycloak-3.2.1

[Guin Ness]

Hi.
I'm trying to get ADFS SAML Identity provider working and stuck on
configuration:
If I set NameIDPolicy!=Unspecified I get InvalidNameIDPolicy from ADFS
(despite the fact that my ADFS supports NameIDPolicy=Persistent)
If I set NameIDPolicy=Unspecified I get Internal server error:
NullPointerException at
org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLEndpoint.java:390).

I am using Keycloak-3.2.1.Final on RHEL7.1

Did anybody encouter this? Is it a bug or did I do something wrong?
Thanks in advanced! ;)