Last tested: Aug 2020
Check to make sure the callback URL is just
myinstance.looker.com/samlcallback. If the URL has anything else in it, like
login, then you might get a 403.
The only exception is with Okta. Okta automatically injects /samlcallback so we'll just need the base url for the instance with no trailing slash.