How to bypass Keycloak login form and jump directly to the IDP login?

As you mentioned, you can bypass the Keycloak screen and go directly to the IdP by setting a default identity provider for the whole realm:

It is possible to automatically redirect to a identity provider instead of displaying the login form. To enable this go to the Authentication page in the administration console and select the Browser flow. Then click on config for the Identity Provider Redirector authenticator. Set Default Identity Provider to the alias of the identity provider you want to automatically redirect users to.

(https://www.keycloak.org/docs/latest/server_admin/index.html#default_identity_provider)

Unfortunately, that's for the whole realm and can't be set dynamically or per SP. kc_idp_hint seems to be the solution, but it's only for OIDC:

OIDC applications can bypass the Keycloak login page by specifying a hint on which identity provider they want to use.

This is done by setting the kc_idp_hint query parameter in the Authorization Code Flow authorization endpoint.

(https://www.keycloak.org/docs/latest/server_admin/#_client_suggested_idp)

It looks like there's a feature request to add kc_idp_hint support for SAML but it's still unresolved:

https://issues.jboss.org/browse/KEYCLOAK-4884

As a workaround, you could create a new realm and set the default identity provider for that realm. That way if you had SPs that needed to be brokered to different IdPs, you could set them up in the appropriate realm.

The downside is each realm acts as its own IdP so it has its own entity ID, public key, etc. You'd effectively have to set the SP up again each time to have it default to a different IdP.

To set an identity provider as the default one ignoring keycloak login form, just go to the authentication menu > Identity Provider Redirector action link > set the default identity provider to the alias of the provider you want. Once you open from browser localhost:8080/realm[...]/account you will be automatically redirected to your provider login page.

It is an old post but maybe still actual for someone.

1. For static redirect on identity provider login page set in the keycloak admin panel set name from Identity Providers -> name to Authentication -> Identity Provider Redirector -> config -> Default Identity Provider. After that happen request to https://{KK}/realms/{RM}/protocol/openid-connect/auth?... will redirect you to identity provider e.g. facebook

2. Dynamic choice idp. If you won't go to idp login page you may put additional param kc_idp_hint in KK e.g.

// go to KK login page with username/pass and choice of idp provider
https://{KK}/realms/{RM}/protocol/openid-connect/auth?...&kc_idp_hint

// go to facebook login page if facebook idp is cinfigure 
https://{KK}/realms/{RM}/protocol/openid-connect/auth?...&kc_idp_hint=facebook

// go to other login page
https://{KK}/realms/{RM}/protocol/openid-connect/auth?...&kc_idp_hint=other

After searching it a lot I managed to do it with this line of code:

keycloakAuth.login({idpHint: 'facebook'});

keycloakAuth being:

keycloakAuth = Keycloak({
    url: environment.keycloakRootUrl,
    realm: 'realm',
    clientId: 'client-id',
    'ssl-required': 'external',
    'public-client': true
});

No need to set it as a default identity provider

kc_idp_hint will work with SAML by passing the IDP alias instead of the IDP display name.

In order to skip SSO, keycloak init first then pass idp_hint to login.

 const options: KeycloakLoginOptions = {
      idpHint: ' ',
    };
    keycloak.init({}).then(() => {
      keycloak.login(options).then(() => {
        onSuccess();
      });
    });

1. In keycloak admin console go to "Authentication" menu -> "Flows" panel -> in the drop down select "Browser" -> click on the "copy" button and call it "Browser2"
2. By selecting "Browser2" you can edit the Auth Type "Identity Provider Redirector" -> "Actions" -> "Config"
3. Under "Alias" and "Default Identity Provider" enter the alias of your saml-identity-provider, previously created in the "Identity Providers" menu
4. In the "Clients" menu select your saml-broker-authentication client and expend "Authentication Flow Overrides" and under the "Browser Flow" drop down select "Browser2" and save
5. Your http://localhost:8080/auth/realms/saml-broker-authentication-realm/broker/sanity-idp/login?client_id=saml-broker-authentication should now directly open the idp and not the keycloak login form.

Then you can create as many Authentication flows as ipd without duplicating the realm.

In order to get redirected to the IDP login page through the Keycloak broker you can use the following URL : http://localhost:8080/saml-broker-authentication/

You can also extend and write new authenticator spi on top of the class IdentityProviderAuthenticator in which authenticate performs redirect() based on request url attribute.

Otherwise most of the cases , kc_idp_hint in resource url will help.

E.g https://resourceserver/resourcepath?kc_idp_hint=google