Cablemodem/app/config/security.yml

security:
    providers:
        oauth:
            id: base_oauth_bundle.oauth_user_provider

    role_hierarchy:

        # CABLEMODEM
        ROLE_SONATA_CABLEMODEM_READER: [ROLE_ADMIN, ROLE_SONATA_ADMIN_CABLEMODEM_LIST, ROLE_SONATA_ADMIN_CABLEMODEM_VIEW]
        ROLE_SONATA_CABLEMODEM_EDITOR: [ROLE_SONATA_CABLEMODEM_READER, ROLE_SONATA_ADMIN_CABLEMODEM_CREATE, ROLE_SONATA_ADMIN_CABLEMODEM_EDIT]
        ROLE_SONATA_CABLEMODEM_ADMIN: [ROLE_SONATA_CABLEMODEM_EDITOR, ROLE_SONATA_ADMIN_CABLEMODEM_DELETE, ROLE_SONATA_ADMIN_CABLEMODEM_EXPORT]

        # PROFILE
        ROLE_SONATA_PROFILE_READER: [ROLE_ADMIN, ROLE_SONATA_ADMIN_PROFILE_LIST, ROLE_SONATA_ADMIN_PROFILE_VIEW]
        ROLE_SONATA_PROFILE_EDITOR: [ROLE_SONATA_PROFILE_READER, ROLE_SONATA_ADMIN_PROFILE_CREATE, ROLE_SONATA_ADMIN_PROFILE_EDIT]
        ROLE_SONATA_PROFILE_ADMIN: [ROLE_SONATA_PROFILE_EDITOR, ROLE_SONATA_ADMIN_PROFILE_DELETE, ROLE_SONATA_ADMIN_PROFILE_EXPORT]

        # NODE
        ROLE_SONATA_NODE_READER: [ROLE_ADMIN, ROLE_SONATA_ADMIN_NODE_LIST, ROLE_SONATA_ADMIN_NODE_VIEW]
        ROLE_SONATA_NODE_EDITOR: [ROLE_SONATA_NODE_READER, ROLE_SONATA_ADMIN_NODE_CREATE, ROLE_SONATA_ADMIN_NODE_EDIT]
        ROLE_SONATA_NODE_ADMIN: [ROLE_SONATA_NODE_EDITOR, ROLE_SONATA_ADMIN_NODE_DELETE, ROLE_SONATA_ADMIN_NODE_EXPORT]

        # CMTS
        ROLE_SONATA_CMTS_READER: [ROLE_ADMIN, ROLE_SONATA_ADMIN_CMTS_LIST, ROLE_SONATA_ADMIN_CMTS_VIEW]
        ROLE_SONATA_CMTS_EDITOR: [ROLE_SONATA_CMTS_READER, ROLE_SONATA_ADMIN_CMTS_CREATE, ROLE_SONATA_ADMIN_CMTS_EDIT]
        ROLE_SONATA_CMTS_ADMIN: [ROLE_SONATA_CMTS_EDITOR, ROLE_SONATA_ADMIN_CMTS_DELETE, ROLE_SONATA_ADMIN_CMTS_EXPORT]

        # CABLEMODEM_MODEL
        ROLE_SONATA_CABLEMODEM_MODEL_READER: [ROLE_ADMIN, ROLE_SONATA_ADMIN_CABLEMODEM_MODEL_LIST, ROLE_SONATA_ADMIN_CABLEMODEM_MODEL_VIEW]
        ROLE_SONATA_CABLEMODEM_MODEL_EDITOR: [ROLE_SONATA_CABLEMODEM_MODEL_READER, ROLE_SONATA_ADMIN_CABLEMODEM_MODEL_CREATE, ROLE_SONATA_ADMIN_CABLEMODEM_MODEL_EDIT]
        ROLE_SONATA_CABLEMODEM_MODEL_ADMIN: [ROLE_SONATA_CABLEMODEM_MODEL_EDITOR, ROLE_SONATA_ADMIN_CABLEMODEM_MODEL_DELETE, ROLE_SONATA_ADMIN_CABLEMODEM_MODEL_EXPORT]

        # CMTS_MODEL
        ROLE_SONATA_CMTS_MODEL_READER: [ROLE_ADMIN, ROLE_SONATA_ADMIN_CMTS_MODEL_LIST, ROLE_SONATA_ADMIN_CMTS_MODEL_VIEW]
        ROLE_SONATA_CMTS_MODEL_EDITOR: [ROLE_SONATA_CMTS_MODEL_READER, ROLE_SONATA_ADMIN_CMTS_MODEL_CREATE, ROLE_SONATA_ADMIN_CMTS_MODEL_EDIT]
        ROLE_SONATA_CMTS_MODEL_ADMIN: [ROLE_SONATA_CMTS_MODEL_EDITOR, ROLE_SONATA_ADMIN_CMTS_MODEL_DELETE, ROLE_SONATA_ADMIN_CMTS_MODEL_EXPORT]

        # WORKFLOW
        ROLE_SONATA_WORKFLOW_READER: [ROLE_ADMIN, ROLE_SONATA_ADMIN_WORKFLOW_LIST, ROLE_SONATA_ADMIN_WORKFLOW_VIEW]
        ROLE_SONATA_WORKFLOW_EDITOR: [ROLE_SONATA_WORKFLOW_READER, ROLE_SONATA_ADMIN_WORKFLOW_CREATE, ROLE_SONATA_ADMIN_WORKFLOW_EDIT]
        ROLE_SONATA_WORKFLOW_ADMIN: [ROLE_SONATA_WORKFLOW_EDITOR, ROLE_SONATA_ADMIN_WORKFLOW_DELETE, ROLE_SONATA_ADMIN_WORKFLOW_EXPORT]

        # ACTION
        ROLE_SONATA_ACTION_READER: [ROLE_ADMIN, ROLE_SONATA_ADMIN_ACTION_LIST, ROLE_SONATA_ADMIN_ACTION_VIEW]
        ROLE_SONATA_ACTION_EDITOR: [ROLE_SONATA_ACTION_READER, ROLE_SONATA_ADMIN_ACTION_CREATE, ROLE_SONATA_ADMIN_ACTION_EDIT]
        ROLE_SONATA_ACTION_ADMIN: [ROLE_SONATA_ACTION_EDITOR, ROLE_SONATA_ADMIN_ACTION_DELETE, ROLE_SONATA_ADMIN_ACTION_EXPORT]

        ROLE_ADMIN_TENANCIES: ROLE_ADMIN_TENANCIES
        ROLE_ADMIN: [ROLE_USER, ROLE_SONATA_ADMIN]
        ROLE_SUPER_ADMIN: [ROLE_ADMIN, ROLE_USER_CREATE, ROLE_ADMIN_TENANCIES, ROLE_ALLOWED_TO_SWITCH]

    firewalls:

        dev:
            context: ik_share
            stateless: false
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false

        api:
          context: ik_share
          pattern: ^/api
          stateless: false
          oauth_proxy: true

        secured_area:
            context: ik_share
            stateless: false
            pattern: ^/
            logout:
                path:   /logout
                target: /
                success_handler: base_admin.security.logout.handler
            anonymous: true
            # HWIOAuthBundle + BaseOAuthBundle Configuration
            oauth:
                login_path: /login
                failure_path: /login
                check_path: /login
                resource_owners:
                    login: /login_check
                oauth_user_provider:
                    service: base_oauth_bundle.oauth_user_provider

    access_control:
        - { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/admin/, role: ROLE_ADMIN }
        - { path: ^/api, role: ROLE_USER }