Stats/app/config/security.yml

security:
    
    providers:
        oauth:
            id: base_oauth_bundle.oauth_user_provider
    
    role_hierarchy:
        ROLE_ADMIN: [ROLE_USER, ROLE_ALLOWED_TO_SWITCH]
        ROLE_SUPER_ADMIN: ROLE_ADMIN
            
    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false
        
        api:
          pattern: ^/api
          stateless: true
          oauth_proxy: true    
            
        secured_area:
            pattern: ^/
            logout:
                path:   /logout
                target: /
                success_handler: base_admin.security.logout.handler
            anonymous: true
            
            # HWIOAuthBundle + BaseOAuthBundle Configuration
            oauth:
                login_path: /login
                failure_path: /login
                check_path: /login
                resource_owners:
                    login: /login_check
                oauth_user_provider:
                    service: base_oauth_bundle.oauth_user_provider
                    
    access_control:
        - { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/admin/, role: ROLE_ADMIN }
        - { path: ^/api, role: ROLE_USER }