Make sure you have added the SSO secret to the sso provider secrets site setting. That setting takes a list of domain/secret pairs. You can set the domain to * to allow the secret to be used for all domains.
If I add the secret to the sso secret setting, instead of the sso provider secrets setting, I get the error that you are reporting.