security:

providers:
    in_memory:
        memory:
            users:
                user:
                    password: user
                    roles: 'ROLE_USER'
                admin:
                    password: admin
                    roles: 'ROLE_ADMIN'

firewalls:
    dev:
        pattern: ^/(_(profiler|wdt)|css|images|js)/
        security: false

    secured_area:
        anonymous: ~
        http_basic: ~
        access_denied_url: backoffice_access_denied

        form_login:
            login_path: /backoffice/login
            check_path: /backoffice/login_check

        logout:
            path:   /backoffice/logout
            target: /backoffice

encoders:
    SymfonyComponentSecurityCoreUserUser: plaintext

role_hierarchy:
    ROLE_ADMIN:       ROLE_USER
    ROLE_SUPER_ADMIN: [ROLE_USER, ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]

access_control:
    - { path: ^/backoffice/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/backoffice, roles: ROLE_ADMIN }

backoffice_logout:
    path: /backoffice/logout

backoffice_login_check:
    path: /backoffice/login_check

[2016-03-02 10:39:54] request.INFO: Matched route "backoffice_login_check". {"route_parameters":{"_route":"backoffice_login_check"},"request_uri":"http://DOMAIN/backoffice/login_check"} []
[2016-03-02 10:39:54] security.INFO: User has been authenticated successfully. {"username":"admin"} []
[2016-03-02 10:39:54] event.DEBUG: Listener "SymfonyComponentSecurityHttpFirewall::onKernelRequest" stopped propagation of the event "kernel.request". [] []
[2016-03-02 10:39:54] event.DEBUG: Listener "SymfonyBundleAsseticBundleEventListenerRequestListener::onKernelRequest" was not called for event "kernel.request". [] []
[2016-03-02 10:39:54] security.DEBUG: Stored the security token in the session. {"key":"_security_secured_area"} []
[2016-03-02 10:39:54] request.INFO: Matched route "backoffice_index_lead". {"route_parameters":{"_controller":"XXX\AppBundle\Controller\DefaultController::leadAction","_route":"backoffice_index_lead"},"request_uri":"http://DOMAIN/backoffice/lead"} []
[2016-03-02 10:39:54] security.INFO: Populated the TokenStorage with an anonymous Token. [] []
[2016-03-02 10:39:54] security.DEBUG: Access denied, the user is not fully authenticated; redirecting to authentication entry point. {"exception":"[object] (Symfony\Component\Security\Core\Exception\AccessDeniedException(code: 403): Access Denied. at /site/vendor/symfony/symfony/src/Symfony/Component/Security/Http/Firewall/AccessListener.php:70)"} []
[2016-03-02 10:39:54] security.DEBUG: Calling Authentication entry point. [] []