"Missing state parameter in response from identity provider" error

Keycloak: 13.0.1

I am debugging SSO via ClassLink. When I do site-initiated SSO via ClassLink, everything goes fine:

Site (SAML) → KeyCloak → Select ClassLink IdP → Log on to ClassLink → Redirected to Keycloak → Redirected to site (logged on)

But when I do IdP-initiated logon, I stop at a Keycloak page with URL like


and a message on the page:

“Missing state parameter in response from identity provider.”

Are any ideas go to handle this one? Thank you.