services:
    oro_distribution.listener.access_denied:
        class: %oro_distribution.security.access_denied_listener.class%
        arguments: ["@session", "@router", "@security.context"]
        tags:
           - { name: kernel.event_listener, event: kernel.exception, method: onAccessDeniedException }

security:
    acl:
        connection: default
        cache:
            id: security.acl.cache.doctrine
            prefix: sf2_acl_

    providers:
        oro_user:
            entity: { class: OroDistributionBundle:Security\User, property: username }

    encoders:
        Oro\Bundle\DistributionBundle\Entity\Security\User: sha512

    firewalls:
        dev:
            pattern:                        ^/(_(profiler|wdt)|css|images|js)/
            security:                       false

        login:
            pattern:                        ^/login$
            security:                       false

        main:
            pattern:                          ^/
            provider:                         oro_user
            form_login:
                check_path:                     oro_distribution_security_login_check
                login_path:                     oro_distribution_security_login
                default_target_path:            oro_distribution_package_listinstalled
                always_use_default_target_path: true
                csrf_provider:                  form.csrf_provider
            remember_me:
                key:                        %secret%
                name:                       BAPRM_DIST
                lifetime:                   1209600   # stay logged for two weeks
                httponly:                   true
            anonymous:                        ~
            logout:
              path:   /logout
              target: /

    access_control:
        - { path: ^/login, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/packages, role: ROLE_ADMINISTRATOR }
        - { path: ^/$, role: ROLE_ADMINISTRATOR }
