I've not done it with WSO2 but I have with Google Apps and Wordpress. Google works, but I currently get a 400 error with Wordpress - I believe this is down to Wordpress not signing the response. Not sure if you have the same issue or not.
As far as I know there shouldn't need to be anything in the middle other than your browser... but I'm not familiar with WSO2. In Google I had to set up attribute mapping, perhaps that needs configuring?
Either way, it might be worth posting some more information - e.g. the metadata XML that you've put into Qlik Sense (with anything private removed of course), sample requests / responses so people can see more detail.