I have an app running on Wildfly 24.01 and configured SSO (with Azure AD). It works perfectly well.
I use NGINX as a reverse proxy (and SSL offloading) infront of Wildfly.

Now after an upgrade to Wildfly 29.01 the SSO function does not work correctly anymore
What happens is:

1. I open the app as usual https://myapp.com/sso-login
2. Microsoft Azure Login Popup box shows, I enter my credentials
3. My browser shows the URL https://myapp.com/sso-login/saml

and that’s it, blank page.

The log file of NGINX shows:

10.x.x.x - - [14/Aug/2024:14:36:18 +0200] "GET /sso-login HTTP/1.1" 200 938 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
10.x.x.x - - [14/Aug/2024:14:36:36 +0200] "POST /sso-login/saml HTTP/1.1" 200 0 "https://login.microsoftonline.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"

Wildfly log file shows the error:

2024-08-14 13:12:53,727 ERROR [org.keycloak.adapters.saml.profile.webbrowsersso.WebBrowserSsoAuthenticationHandler:237] [QUaKC5r811st] []  (default task-4) 
Request URI 'http://myapp.com/sso-login/saml' does not match SAML request destination 'https://myapp.com/sso-login/saml'

Here it is, http://myapp.com…. I have checked my configuration files of Wildfly over and over again, nowhere I use http://. I haven’t changed the Wildfly config file during the upgrade. Also, Azure AD SSO configuration has not been changed at all.

My nginx.conf looks like this:

upstream wildfly {
    server 127.0.0.1:8080 weight=100 max_fails=5 fail_timeout=5;
}

server {
  server_tokens off;
  return 301 https://myapp.com$request_uri;
}

server {
  listen          443 ssl;
  server_name     _;
  client_max_body_size 25M;

  server_tokens off;

  ssl_certificate       /etc/ssl/certs/io.crt;
  ssl_certificate_key   /etc/ssl/private/io.key;
  ssl_protocols TLSv1.2;
  ssl_session_cache shared:SSL:30m;

  ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
  ssl_prefer_server_ciphers on;

  location = / {
    return 302 /tim/client;
  }

  location / {
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Server $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    proxy_set_header X-Forwarded-Ssl on;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_http_version 1.1;

    proxy_set_header X-Real-IP $remote_addr;
    proxy_pass http://wildfly;
  }
}

Any ideas?