In my case it turned out that the user group had insufficient permissions to the path that IDP redirected me to. E.G. when IDP redirects you to /content/saml_login, check the /content permissions.Logs did not say anything, so it's worth to check that too.