"Missing state parameter in response from identity provider" error

Getting advice
1

Keycloak: 13.0.1

I am debugging SSO via ClassLink. When I do site-initiated SSO via ClassLink, everything goes fine:

Site (SAML) → KeyCloak → Select ClassLink IdP → Log on to ClassLink → Redirected to Keycloak → Redirected to site (logged on)

But when I do IdP-initiated logon, I stop at a Keycloak page with URL like

https://keycloak.domain/auth/realms/Sandbox/broker/idp/endpoint?code=c1623663720908f736b5c376ec96196b5feb03c00b8ee8&response_type=code

and a message on the page:

“Missing state parameter in response from identity provider.”

Are any ideas go to handle this one? Thank you.