SAML SSO authentication via BIG-IP Edge Client for network access

Yes we have assigned a full webtop in advanced resource assign.

SAML response from the Idp is also success with the saml identity in the subject.

After the SAML auth request we are redirected to the start of the VPN access policy which is a decision box. We use a decision box at the start as this is a lab setup used for multiple purposes. I'll try to setup without a decision box and see if that works better as I see this after the SAML auth request: xxx:8fa347d4: Executed agent 'xxx_act_saml_auth_ag', return value 3 ('Need User input'). Even before the SAML success reponse is received from the Idp