Troubleshooting
With the Redirect binding, the request is compressed (deflate) before base64. A tool that only decodes base64 sees unreadable characters.
Probable cause. With the Redirect binding, the request is compressed (deflate) before base64. A tool that only decodes base64 sees unreadable characters.
To see exactly which check fails, paste the response into theanalyseur, or paste the message into the diagnostic.
All SAML and OpenID Connect errors
Want to see it for real? ID-Kit plays the role you are missing and shows you each step.