When configuring SSO the options are OpenID Connect (OIDC) and SAML (like used in Shibboleth). The IdP config does offer to "Test IdP" but when the error is displayed and the IdP is blamed for having insufficiently provided matching key/value pairs, there's no display of what actually was received. That does not help in understanding what the ControlHub is lacking in the IdP response and how the customer can/should go about addressing this problem.