Unable to use reverse-proxy with Shibboleth IDP

[Mert Metin]

Hello everybody,

I am having trouble to use reverse-proxy with Shibboleth IDP.
Let me give some details:

I have a server with bunch of dockers — a docker for reverse proxy with NGINX, a docker for Shibboleth SP and Shibboleth IDP. SP is served over sp.example.com <http://sp.example.com/> and IDP is served over idp.example.com <http://idp.example.com/>. Both URLs have valid SSL certificate from Let’s encrypt.

SP works perfectly fine. However, I am having trouble for the IDP.
Whenever I go to, idp.example.com <http://idp.example.com/>, Chrome gives ERR_INVALID_RESPONSE
When I try with Safari, it downloads a single file — and that file includes a single letter “P”. Weird, right?

I go through logs of both Shibboleth IDP and NGINX. The IDP logs doesn’t show any error. However, NGINX shows the error below:

upstream sent no valid HTTP/1.0 header while reading response header from upstream


It looks like Tomcat or Jetty in iDP container doesn’t return a proper HTTP header — or response? 

I searched through this error. However, I didn’t get anywhere. Does anyone have an idea?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190607/d655fb3e/attachment.html>