title: Spring Boot 2 and migrating OAuth2 configuration
body: <p>We are migrating our Spring Boot 1.5.7 application to Spring Boot 2 and I noticed that <code>SecurityProperties.ACCESS_OVERRIDE_ORDER</code> is not available anymore.</p>
  
  <p>We were using <code>@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER))</code> to force a certain order of security config filters and it is not working without this annotation anymore (getting different statuses since the security filters are in a wrong order). Is there some replacement or configuration change to make it work in the old way?</p>
  
  <p>We have basic auth + OAuth2 in place.</p>
  
  <p>This is the OAuth2 dependency we use:</p>
  
  <pre><code>compile group: 'org.springframework.security.oauth', name: 'spring-security-oauth2', version: '2.1.0.RELEASE'
  </code></pre>
  
  <p>EDIT: this is my WebSecurity properties:</p>
  
  <pre><code>@Configuration
  @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
    private static final String LOGIN = "/login";
    private static final String LOGOUT_SUCCESS = "/login?logout";
  
    private final UserDetailsService userDetailsService;
    private final AuthenticationManager authenticationManager;
  
    public WebSecurityConfig(UserDetailsService userDetailsService, @Lazy AuthenticationManager authenticationManager) {
      this.userDetailsService = userDetailsService;
      this.authenticationManager = authenticationManager;
    }
  
    @Override
    protected void configure(HttpSecurity http) throws Exception {
  
      // @formatter:off
      http
        // enable cors
        .cors().and()
        .requestMatchers().antMatchers("/oauth/**", "/*").and()
        // These from the above are secured by the following way
        .authorizeRequests().antMatchers("/").permitAll()
        // These from the rest are secured by the following way
        .anyRequest().authenticated().and()
        // Set login page
        .formLogin().loginPage(LOGIN).permitAll().defaultSuccessUrl(PROFILE)
        // Set logout handling
        .and().logout().logoutSuccessUrl(LOGOUT_SUCCESS);
        // @formatter:on
  
    }
  
    @Override
    public void configure(WebSecurity web) throws Exception {
      web.ignoring().antMatchers(HttpMethod.OPTIONS, "/**");
    }
  
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
      auth.parentAuthenticationManager(authenticationManager);
      auth.userDetailsService(userDetailsService);
    }
  
  }
  </code></pre>
  
  <p>When accessing <code>/user</code> via REST, I expect to get <code>401 - Unauthorized</code> without a valid token. Instead, I get <code>302 - Redirect to /login</code> meaning that basic auth has higher priority. I am not sure how to fix this since any order I try to use does not work.</p>