There is also a spring-boot-autoconfigure-2.0.. release.jar in the start of 2.0 by default. If you also refer to activiti’s activiti-spring-boot-starter-rest-api.jar package, you need to exclude securityautoconfiguration.class in both packages
Write it in the startup class
@SpringBootApplication(exclude={
org.activiti.spring.boot.SecurityAutoConfiguration.class,
SecurityAutoConfiguration.class
})