Thanks @jbman. The IDP lists the application that is connected to keycloak. On clicking the application on the IDP, the browser navigates to keycloak but then, fails with a HTTP 400, bad request error.
Would you be able to point me to some documentation with a working example?

Additional information:

1. The IDP that I am using is JumpCloud. I have setup an app in jumcloud
2. This app has been linked to an Identity Provider that has been created on my keycloak instance.
3. I have also created a SAML client on keycloak.
4. I logon as a non-admin user to jumpcloud (the jumpcloud admin user has allowed access to the app created in step 1)
5. Click on the app in jumpcloud. The browser navigates to keycloak but does not SSO. Request fails.

Like I said in my previous comments, all of the SSO documentation that I see in the community do not clearly describe the above workflow. From what I can find in the online community samples, the user always starts the workflow at the keycloak login page, clicks on the 'Login with Jumpcloud' button, authenticates with Jumpcloud and is then redirected to keycloak successfully and is logged in with an active keycloak session.

With Keycloak as Identity Broker in between you relying party app and JumpCloud, an IdP initiated login page provided by Jumpcloud can't work.
When you use identity brokering, you need to build a custom page which links to your application login URL. So in fact login is initiated at this page but only to trigger RP initiated login at the application. At this page you also need to be aware of the IdP the user is logged in with. Then you can pass it to the application which passes it to keycloak with URL parameter kc_idp_hint=jumpcloud, which does login with this provider. (See https://www.keycloak.org/docs/latest/server_admin/#_client_suggested_idp)

Keycloak itself could provide also a "connected applications" page. It would be based on clients and would need a login URL configured at the client. This login URL should directly trigger login at the application (while the base URL may by visible without login).