@Mantas hello, my problem resolved, my issue caused by proxy
Background:
our test env cannot acquire openid connect meta config(due to network, connect url is not avaiable directly), so we use nginx to proxy, this maybe cause idToken is invalid（iss in JWT is inconsistent with openid connect domain）, refer below:
After revised(using another openid connect url):
SSO login sucessfully:
thank you so much, sincerely!