[keycloak-user] SAML 2.0 Broker Kickoff - Config Issue or Bug?

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi all, I'm trying to drop into a SAML 2.0 brokered flow, and I can't seem to get Keycloak to kick if off right. Here's what I'm doing: 1) Setting up a third-party IDP as an Identity Provider by importing SAML 2.0 metadata. 2) Attempting a standard login flow against a client, then clicking the newly added identity provider on the login screen. 3) Watch, as Keycloak gives me an "Invalid Request" error message After looking under the hood, I can see that it's fussing about not having a ClientID: [2018-10-24 20:12:41,591+0000] DEBUG [org.keycloak.services.resources.IdentityBrokerService] (default task- 61) Invalid request. Authorization code, clientId or tabId was null. Code=IugzCrTYU0xfZ_sLF1prPRTZC5WsR9-F3HrDyCUegLE, clientId=null, tabID=vPZ0M6-0eao I also just attempted with a Github provider, and encountered the same issue. Not sure what's going on, as the IdentityProviderBean doesn't use the clientId (as I'd imagine it shouldn't?) when constructing the provider urls, seems strange that it would be required: String loginUrl = Urls.identityProviderAuthnRequest(baseURI, identityProvider.getAlias(), realm.getName()).toString(); Sooo... can someone help me figure out what I'm doing wrong here? I'm guessing user error is the problem here (otherwise, alot of brokering would be busted). Thanks! - -- Josh Cain Senior Software Applications Engineer, RHCE Red Hat North America