security.yml

security:
    encoders:
        # Our use class and the algorithm we'll use to encode passwords
        # http://symfony.com/doc/current/book/security.html#encoding-the-user-s-password
        AppBundle\Entity\Identity:
            algorithm: bcrypt
            cost:      15
#        AppBundle\Entity\Identity:
#            algorithm:            pbkdf2
#            hash_algorithm:       sha512
#            encode_as_base64:     true
#            iterations:           10
#            key_length:           40

    providers:
        # in this example, users are stored via Doctrine in the database
        # To see the users at src/AppBundle/DataFixtures/ORM/LoadFixtures.php
        # To load users from somewhere else: http://symfony.com/doc/current/cookbook/security/custom_provider.html
        database_users:
            entity: { class: AppBundle:Identity, property: email }

    # http://symfony.com/doc/current/book/security.html#firewalls-authentication
    firewalls:
        bundle_data:
            pattern: ^/bundles
            security: false

        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false

        secured_area:
            # this firewall applies to all URLs
            pattern: ^/

            # but the firewall does not require login on every page
            # denying access is done in access_control or in your controllers
            anonymous: ~

            # This allows the user to login by submitting a username and password
            # Reference: http://symfony.com/doc/current/cookbook/security/form_login.html
            form_login:
                # The route name that the login form submits to
                check_path: account_authenticate
                # The name of the route where the login form lives
                # When the user tries to access a protected page, they are redirected here
                login_path: account_login

            logout:
                # The route name the user can go to in order to logout
                path: account_logout
                # The name of the route to redirect to after logging out
                target: homepage

    access_control:
        - { path: ^/[a-z]+/account/(renew-credentials|login|register|thank-you), role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/bundles, role: IS_AUTHENTICATED_ANONYMOULSY }
        - { path: ^/[a-z]+/admin, role: ROLE_ADMIN }
        - { path: ^/, roles: IS_AUTHENTICATED_REMEMBERED }