[keycloak-user] SAML User Roles (app-profile-saml-jee-jsp )

Hey folks, I'm having some trouble getting the app-profile-saml-jee-jsp quickstart up and running. I'm getting a Forbidden for my demo user "alice" in the demo realm demo. I followed the quickstart readme pretty thoroughly I thought but I'm wondering if maybe there's a role that needs to be added to the use "alice" that's specific to SAML that isn't mentioned? The same user seems to work fine for quickstarts that are OpenID Connect. I'm running Wildfly 15.0.0.Final and Keycloak-5.0.0 with Maven 3.6.0 and OpenJDK8 on Debian Buster. Thanks! Joe