Hello, Thanks for responding so quickly. I was not able to see the error in the logs. However, after setting up a local instance of Keycloak I was able to track it down. You are correct I was not using SP-initiated SSO. After changing the configurations in Keycloak the relay state was being passed correctly. The client id was no longer null and I was able to authenticate. Thanks again, Chris -- On 7/30/19, 2:27 PM, "Dmitry Telegin (Carretti Consulting)" <carretti.pro(a)gmail.com&gt; wrote: at java.util.regex.Matcher.getTextLength(Matcher.java:1283) at java.util.regex.Matcher.reset(Matcher.java:309) at java.util.regex.Matcher.<init>(Matcher.java:229) at java.util.regex.Pattern.matcher(Pattern.java:1093) at java.util.regex.Pattern.split(Pattern.java:1206) at org.keycloak.broker.provider.util.IdentityBrokerState.encoded(IdentityBrokerState.java:41) at org.keycloak.services.resources.IdentityBrokerService.parseEncodedSessionCode(IdentityBrokerService.java:987) at org.keycloak.services.resources.IdentityBrokerService.authenticated(IdentityBrokerService.java:497) at org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLEndpoint.java:465)