title: How to disable actuator security without disabling it totally with Spring Boot 2
body: <p>I'm using Spring Boot Security with OAuth2. I wan't to disable security for health endpoint.</p>
  
  <p>I can totally disable security or write my own implementation of <code>WebSecurityConfigurerAdapter</code> and disable autoconfigured one.</p>
  
  <p>But how to modify existing implementation of <code>WebSecurityConfigurerAdapter</code> (<code>OAuth2SsoDefaultConfiguration</code>)?</p>
  
  <p>I tried to create my own configuration without disabling autoconfigured one, but it is impossible due to <code>Order</code> conflicts.</p>
  
  <p>Here is the error message:</p>
  
  <pre><code>Caused by: java.lang.IllegalStateException: @Order on WebSecurityConfigurers must be unique. 
  Order of 100 was already used on SecurityConfiguration$$EnhancerBySpringCGLIB$$9505fc58@13f182b9,
   so it cannot be used on 
  org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2SsoDefaultConfiguration$$EnhancerBySpringCGLIB$$dc290e2b@5ee0cf64 too.
  </code></pre>
  
  <p>Also, I tried to explicitly set higher order for my own security configuration, but looks like autoconfigured one overrides mine.</p>
  
  <p>So how to override specific security rules without reimplementing whole configuration?</p>