Tomcat behind Nginx reverse proxy - Recipient endpoint doesn't match with SAML response

Here are the components:

1. Spring MVC web app on tomcat
2. Azure AD IdP
3. Nginx reverse proxy

The SSO works without Nginx reverse proxy, hence i suppose the configuration for my app and AzureID is done correctly. However i faced an error when nginx reverse proxy comes into play. Here's the log error

2021-02-17 19:05:14,690 172.18.0.2 /saml/SSO/alias/my_app [ERROR] org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder - SAML message intended destination endpoint https://myapp.example.com/saml/SSO/alias/my_app did not match the recipient endpoint http://myapp.example.com/saml/SSO/alias/my_app;

Not sure why http instead of https is passed upstream to tomcat. I followed the best practice to setup SSL for nginix. Here's the config for myapp

server {
    listen 80;
    server_name   _;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;

    server_name myapp.example.com;

    access_log logs/myapp.access;
    error_log logs/myapp.error error;

    location / {

        proxy_set_header    X-Forwarded-Host    $host;
        proxy_set_header    X-Forwarded-Server  $host;
        proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
        proxy_set_header    X-Forwarded-Proto   https;
        proxy_set_header    X-Real-IP           $remote_addr;
        proxy_set_header    Host                $host;
        proxy_pass          http://myapp:8180/;
    }
}

Any i missing anything? Any comments will be greatly appreciated.

EDIT: Quick solution The issue was that tomcat does not process the X-Forwarded-Proto to the servlets. There are few ways to resolve this. The easiest is to add scheme attribute to the <Connector> in server.xml

You can refer to tomcat config document on the attributes definition. https://tomcat.apache.org/tomcat-9.0-doc/config/http.html

<Connector port="8080" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="8443" 
               proxyName="myapp.example.com"
               proxyPort="443"
               **scheme="https"** />