Category Archives: pingfederate

PingFederate NGINX Reverse Proxy Issues

While configuring NGINX as a reverse proxy for a PingFederate cluster, I kept running into an issue where the PF nodes would reject my authentication requests with the following error:

DEBUG [com.pingidentity.pf.adapters.referenceid.PickupHandler] Auth failed: javax.security.auth.login.LoginException: Multiple adapter instances are configured, ping.instanceId header is required

It turns out that NGINX strips away headers that include invalid characters, in this case “ping.instanceId” contains a period, and is thus an “invalid header” according to NGINX. The fix for this was to add the following to the NGINX server configuration, under the PF cluster server section:

ignore_invalid_headers off;