Hi,

I’m working on moving SAML auth in one app into Keycloak. Since we have many clients hitting our existing API, we don’t want to change the external API. Instead we need to proxy through to Keycloak. I have a SAML test harness that generates the SAML doc and redirects to KC, but I constantly get a staleCodeError int he logs and the following error on the page it redirects to.

WE'RE SORRY ...

This page is no longer valid, please go back to your application and login again

I’ve setup an Identity Provider named “saml” and pointed my test app to the Redirect URI (http://192.168.99.100:10080/auth/realms/demo/broker/saml/endpoint). Config screenshot attached (if it isn’t stripped from email)

Am I doing something wrong, or is this just not a use case Keycloak is designed for?