Cannot connect with caldav when using SAML

Steps to reproduce

1. Configure a SAML Endpoint (in my case it's keycloak)
2. Try to connect Nextcloud with KOrganizer or other caldav clients.

Expected behaviour

In Nextcloud Client there is a new Popup with the Keycloak login page. Something like this should also work in other tools

Actual behaviour

401 Not Authorized

Its clear because Nextcloud did not have any credentials of the user.

Server configuration detail

Operating system: Linux 3.16.0-042stab127.2 #1 SMP Thu Jan 4 16:41:44 MSK 2018 x86_64

Webserver: nginx/1.6.2 (fpm-fcgi)

Database: mysql 10.0.32

PHP version: 5.6.33-0+deb8u1
Modules loaded: Core, date, ereg, libxml, openssl, pcre, zlib, bcmath, bz2, calendar, ctype, dba, dom, hash, fileinfo, filter, ftp, gettext, SPL, iconv, mbstring, session, posix, Reflection, standard, shmop, SimpleXML, soap, sockets, Phar, exif, sysvmsg, sysvsem, sysvshm, tokenizer, wddx, xml, xmlreader, xmlwriter, zip, cgi-fcgi, PDO, apcu, curl, gd, imagick, intl, json, ldap, mcrypt, mysql, mysqli, pdo_mysql, readline, tidy, mhash, apc, Zend OPcache

Nextcloud version: 13.0.4 - 13.0.4.0

Updated from an older Nextcloud/ownCloud or fresh install:

Where did you install Nextcloud from: unknown

Enabled:
 - activity: 2.6.1
 - calendar: 1.6.1
 - comments: 1.3.0
 - dav: 1.4.7
 - federatedfilesharing: 1.3.1
 - federation: 1.3.0
 - files: 1.8.0
 - files_sharing: 1.5.0
 - files_texteditor: 2.5.1
 - files_trashbin: 1.3.0
 - files_versions: 1.6.0
 - files_videoplayer: 1.2.0
 - gallery: 18.0.0
 - issuetemplate: 0.3.0
 - logreader: 2.0.0
 - lookup_server_connector: 1.1.0
 - nextcloud_announcements: 1.2.0
 - notifications: 2.1.2
 - oauth2: 1.1.1
 - password_policy: 1.3.0
 - provisioning_api: 1.3.0
 - serverinfo: 1.3.0
 - sharebymail: 1.3.0
 - survey_client: 1.1.0
 - systemtags: 1.3.0
 - theming: 1.4.5
 - twofactor_backupcodes: 1.2.3
 - updatenotification: 1.3.0
 - user_saml: 1.5.0
 - workflowengine: 1.3.0
Disabled:
 - admin_audit
 - encryption
 - files_external
 - files_pdfviewer
 - firstrunwizard
 - user_external
 - user_ldap

{
    "instanceid": "***REMOVED SENSITIVE VALUE***",
    "passwordsalt": "***REMOVED SENSITIVE VALUE***",
    "secret": "***REMOVED SENSITIVE VALUE***",
    "trusted_domains": [
        "**REMOVED**"
    ],
    "datadirectory": "***REMOVED SENSITIVE VALUE***",
    "overwrite.cli.url": "**REMOVED**",
    "dbtype": "mysql",
    "version": "13.0.4.0",
    "dbname": "***REMOVED SENSITIVE VALUE***",
    "dbhost": "***REMOVED SENSITIVE VALUE***",
    "dbport": "",
    "dbtableprefix": "oc_",
    "dbuser": "***REMOVED SENSITIVE VALUE***",
    "dbpassword": "***REMOVED SENSITIVE VALUE***",
    "installed": true
}

Start by reproducing the SAML setup with KOrganizer or another CalDAV client and compare it with the Nextcloud Client login flow. Trace the authentication request that results in 401 Not Authorized; done means supported CalDAV clients can authenticate through the configured SAML endpoint instead of receiving 401.