Our system has duende identityserver to manage user and authorization rules for call apis.
I create java spring boot restful api, include 2 apis – login and get-report.

Login api call duende identityserver and everything ok, i have response to provide token, role…

Second step, i used token from login, add header used bearer token for api get-report.

This is my config for security. Permit all request can call login api, other request need authenticated via identityserver. I added endpoint for authorizationUri,tokenUri,userInfoUri like duende documents present.

 @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.cors().configurationSource(request -> new CorsConfiguration().applyPermitDefaultValues())
            .and()
            .csrf().disable()
            .authorizeRequests()
            .antMatchers("/api/login").permitAll()           
            .anyRequest().authenticated()
            .and()
            .oauth2Login()
            .clientRegistrationRepository(clientRegistrationRepository())
            .and()
            .oauth2ResourceServer()
            .jwt()
            .jwtAuthenticationConverter(jwt -> {
                return new JwtAuthenticationToken(jwt);
            });
    }

@Bean
    public JwtDecoder jwtDecoder() {
        return new NimbusJwtDecoderJwkSupport("http://myip:5001/.well-known/openid-configuration/jwks");
    }

    @Bean
    public ClientRegistrationRepository clientRegistrationRepository() {
        ClientRegistration clientRegistration = ClientRegistration.withRegistrationId("custom-oauth")
            .clientId("clienId")
            .clientSecret("clienKey")
            .clientAuthenticationMethod(ClientAuthenticationMethod.BASIC)
            .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
            .redirectUriTemplate("https://localhost:44300/signin-oidc")
            .scope("report", "common")           
            .authorizationUri("http://myIP:5001/connect/authorize")
            .tokenUri("http://myIP:5001/connect/token")
            .userInfoUri("myIP:5001/connect/userinfo")         
            .userNameAttributeName("id")
            .clientName("Custom OAuth2 Client")
            .build();
        return new InMemoryClientRegistrationRepository(clientRegistration);
    }

When i test call get-report api, it show http response code 200, but content show other error.
Check Duende IdentityServer ,trace log error it show

Duende.IdentityServer.Validation.AuthorizeRequestValidator
code_challenge is missing

I searched and solution for fix code_challenge is missing is disable PKCE in server, but it still has this error. And i have create custom pkce to implement, but version in my springboot framework conflict. My pom.xml has this lib and version

<parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>2.1.6.RELEASE</version>
</parent>

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-oauth2-client</artifactId>    
</dependency>

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-oauth2-resource-server</artifactId>
    <version>5.1.13.RELEASE</version>
</dependency>

So how i can fix this problem?