Important

You are browsing upcoming documentation for version 6.1 of OroCommerce, scheduled for release in 2025. Read the documentation for version 6.0 (the latest LTS version) to get up-to-date information.

See our Release Process documentation for more information on the currently supported and upcoming releases.

OroSecurityBundle

OroSecurityBundle extends Symfony security capabilities to enable a role-based ACL security system in the Oro applications.

The bundle enables developers to set up access restrictions for entities and non-entity related actions using the PHP attributes and the YAML configuration files. It also provides UI for application administrators to configure the entity-specific permissions for particular user roles based on the entity ownership.

Related Documentation

• Introduction to Security in Oro Applications

  • Access Control Lists

  • Permissions for Entities

  • Protecting Resources

• OroSecurityBundle Features

  • ACL Manager

  • Field ACL

  • Custom Listeners

  • Access Rules

  • HTTP Security Response Headers

• Custom and Configurable Permissions

  • How to Configure and Apply Custom Permissions to an Entity

  • How to Work with Configurable Permissions

• Global View Entities

Tip

Take a look an how ACL works in the application in the Access Levels and Ownership topic which illustrates the hierarchy of two sample organizations and access setup within them.