What is the exact error you are getting? I think the no login config log comes in general too, try running this command log show --last 10m --info --predicate 'subsystem contains "com.apple.AppSSO" OR process contains "AppSSO"' and send the output

I have found this https://github.com/twocanoes/psso-server-go which gives a good understanding on the things needed on the IdP server side. Also the Apple documentation like https://developer.apple.com/documentation/authenticationservices/registering-devices-and-users and other related articles gives a rough idea around the IdP side implementation