As mentioned in this guide SAML got a little more strict between 7.9 and 8.9. Even though the guide talks about IIS, can you take a look and see if it makes sense for you?
First, your Identity Provider must be aware it should redirect to an HTTPS URL rather than HTTP. This can be accomplished by adding the server variable HTTP_X_FORWARDED_PROTO set to https in your Reverse Proxy Inbound Rule