[keycloak-user] invalid_token with SAML HTTP redirect binding

Hello, I'm trying to implement SAML authentication with the help of keycloak, but I cannot make it work. I'm running keycloak 4.0.0.Final as a standalone server distribution on ubuntu 16.04 . I've configured a new SAML identity provider from the "Identity Providers" menu by filling in only the required fields. From command line, I'm sending the following request to my keycloak instance:     curl http://192.168.2.165:8080/auth/realms/master/broker/saml/endpoint?SAMLReq... where the SAMLRequest parameter value is the url_encode of base64+deflate (generated from https://www.samltool.com/encode.php) of the following SAML request: <samlp:AuthnRequest ID="_abc123szs" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" IssueInstant="2018-06-18T16:35:21Z" Version="2.0"></samlp:AuthnRequest> Keycloak returns "Invalid Request" in the HTML reply. I've enabled verbose debugging and this is the trace: 23:11:11,462 DEBUG [org.jboss.resteasy.resteasy_jaxrs.i18n] (default task-4) RESTEASY002315: PathInfo: /realms/master/broker/saml/endpoint 23:11:11,463 DEBUG [org.keycloak.saml.SAMLRequestParser] (default task-4) SAML Redirect Binding 23:11:11,463 DEBUG [org.keycloak.saml.SAMLRequestParser] (default task-4) <samlp:AuthnRequest ID="_abc123szs" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" IssueInstant="2018-06-18T16:35:21Z" Version="2.0"></samlp:AuthnRequest> 23:11:11,471 WARN  [org.keycloak.events] (default task-4) type=LOGIN_ERROR, realmId=master, clientId=null, userId=null, ipAddress=192.168.2.221, error=invalid_token The debug trace shows that the request is decoded properly, but I get the "invalid_token" warning. If I redirect an HTTP client via a 302 request to the url above I get the same "Invalid Request" and inability to proceed with login. I've also tried with different sample SAML requests XML, but the result are the same. Do you have any clue? Regards, Emanuele