Message contains error: 'login_required', error_description: 'The client specified not to prompt, but the user is not logged in.', error_uri: 'error_uri is null'

That indicates to me that your application is sending prompt=none in its /authorize request. Are you currently using the /authn endpoint to receive a sessionToken and then sending that to /authorize?

Check out my response over here for the reason you are likely seeing this behavior: Generating OIDC Token using PKCE with MFA - #2 by andrea