"Unable to Sign In" and "Invalid username or password" Error With SAML After Upgrading

Issue

After SAML is enabled, going to the Tableau Server page results in the message:

"Unable to Sign In - Invalid username or password".

Environment

Tableau Server 2018.3.1
SAML
SSL Offloading through Proxy or Load Balancer

Resolution

Configure the proxy or load balancer to set the X-FORWARDED-PROTO header to "https".
Alternately, configure External SSL on Tableau Server as well for full passthrough SSL.

Cause

The SAML code now checks to ensure that the AuthNRequest is going to the expected SAML endpoint.If SSL offloading is enabled through a proxy, the Return URL used for SAML will be https://<url>, but unless the X-FORWARDED-PROTO header is configured, Tableau Server will be expecting an endpoint of http://<url> since External SSL will not be configured on Tableau Server.

Additional Information

The vizportal logs will show the error:

2018-11-01 15:47:28.290 +0000 (,,,,) catalina-exec-14 : ERROR org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder - SAML message intended destination endpoint 'https://<server url>/wg/saml/SSO/index.html' did not match the recipient endpoint 'http://<server url>wg/saml/SSO/index.html'