Important

You are browsing documentation for version 5.1 of OroCommerce, supported until March 2027. Read the documentation for the latest LTS version to get up-to-date information.

See our Release Process documentation for more information on the currently supported and upcoming releases.

Security

OroSecurityBundle extends Symfony security capabilities to enable a role-based ACL security system in the Oro applications.

Developers can set up access restrictions for entities and non-entity-related actions using DOC-block annotations and YAML configuration files.

Application administrators get a UI to configure entity-specific permissions for particular user roles based on entity ownership.

Read more in the following topics:

• Introduction to Security in Oro Applications

  • Access Control Lists

  • Permissions for Entities

  • Protecting Resources

• Access Levels and Ownership Illustration

• OroSecurityBundle Features

  • ACL Manager

  • Field ACL

  • Custom Listeners

  • Access Rules

• Custom and Configurable Permissions

  • How to Configure and Apply Custom Permissions to an Entity

  • How to Work with Configurable Permissions

• Global View Entities

• Security Response Headers