Q: Is Symfony 2 security hard to implement with RBAC? I am coming from Yii 1.1.x, and I have been successful in the implementation of roles for an application, example, check access for document.metadata.edit, which was a child of document.metadata.administrator permission.
Now I am reading a lot about Symfony 2 but cannot understand if the same can be done.
I saw ACL but it says that you can define up to 30-32 rules only, depending in the system:

You can define up to 32 base permissions (depending on your OS PHP
  might vary between 30 to 32). In addition, you can also define
  cumulative permissions.

I were also saving the roles in the DB, but in Symfony it seems to be saved in the configuration file.
In Symfony 2, can the roles be created dynamically in the DB, added to a member, then checked in the code? Or is it much more difficult to achieve?
One common thing in my first app was that given a predefined set of low level permissions that were checked in the code, you could create your own role and add those permissions to the role.
I guess I will have to make a bundle to manage it, or does already exists one?
Thanks a lot.

A: For simple role-based configuration You can start from looking into Voters and Hierarchical Roles. It's a rule of thumb, that You will hardly need Symfony ACLs - these are much more sophisticated than simple voters and only very special use-cases will exploit the full potential of Symfony ACLs.
As stated in Symfony voters page:

In Symfony, you can check the permission to access data by using the ACL module, which is a bit overwhelming for many applications. A much easier solution is to work with custom voters, which are like simple conditional statements.


A: If you need to go down to that level then the Security Bundle has ACLs that can be defined and used at any granularity  http://symfony.com/doc/current/cookbook/security/acl.html
