Does anyone have FA successfully working as an idP for AWS Elastic Load Balancer, using ELB's built-in OIDC functionality?

I have been successfully using ELB with AzureAD as an OIDC idP, but would like to add a new instance with FusionAuth+passwordless. So far my efforts have not been successful, and I have very little to go on.

I've been able to get a redirect to the login UI, login works, but then the load balancer returns 500 Internal Server Error at /oauth2/idpresponse?code=[xxx]&locale=en_US&state=[xxx]&userState=Authenticated. As a managed service, AWS is kind of a black box but what bothers me is FA doesn't appear to be doing anything either. Even with debugging enabled, I have yet to see any debugging log of any kind -- I turned it off and on again, re-saved, even created a whole new app and still nothing.

Amazon suggests a 500 error could be due to communicating with the idP, but without debugging on either side I can't really determine what's happening.

I have tried both 1.28.0 and 1.28.1 from deb packages, on Ubuntu 20.04 LTS. Any tips most welcome, I'm scratching my head here.