diff --git a/application/controllers/SecurityController.php b/application/controllers/SecurityController.php
index c3f9dc60d..bcd83a5c3 100644
--- a/application/controllers/SecurityController.php
+++ b/application/controllers/SecurityController.php
@@ -5,6 +5,7 @@
 use Icinga\Application\Config;
 use Icinga\Form\ConfirmRemovalForm;
 use Icinga\Form\Security\PermissionForm;
+use Icinga\Form\Security\RestrictionForm;
 use Icinga\Web\Controller\ActionController;
 use Icinga\Web\Notification;
 use Icinga\Web\Request;
@@ -127,4 +128,115 @@ class SecurityController extends ActionController
         $this->view->name = $name;
         $this->view->form = $confirmation;
     }
+
+    public function newRestrictionAction()
+    {
+        $restriction = new RestrictionForm(array(
+            'onSuccess' => function (Request $request, RestrictionForm $restriction) {
+                $name = $restriction->getElement('name')->getValue();
+                $values = $restriction->getValues();
+                try {
+                    $restriction->add($name, $values);
+                } catch (InvalidArgumentException $e) {
+                    $restriction->addError($e->getMessage());
+                    return false;
+                }
+                if ($restriction->save()) {
+                    Notification::success(t('Restriction set'));
+                    return true;
+                }
+                return false;
+            }
+        ));
+        $restriction
+            ->setIniConfig(Config::app('restrictions', true))
+            ->setRedirectUrl('security')
+            ->handleRequest();
+        $this->view->form = $restriction;
+    }
+
+    public function updateRestrictionAction()
+    {
+        $name = $this->_request->getParam('restriction');
+        if (empty($name)) {
+            throw new Zend_Controller_Action_Exception(
+                sprintf($this->translate('Required parameter \'%s\' missing'), 'restriction'),
+                400
+            );
+        }
+        $restriction = new RestrictionForm();
+        try {
+            $restriction
+                ->setIniConfig(Config::app('restrictions', true))
+                ->load($name);
+        } catch (InvalidArgumentException $e) {
+            throw new Zend_Controller_Action_Exception(
+                $e->getMessage(),
+                400
+            );
+        }
+        $restriction
+            ->setOnSuccess(function (Request $request, RestrictionForm $restriction) use ($name) {
+                $oldName = $name;
+                $name = $restriction->getElement('name')->getValue();
+                $values = $restriction->getValues();
+                try {
+                    $restriction->update($name, $values, $oldName);
+                } catch (InvalidArgumentException $e) {
+                    $restriction->addError($e->getMessage());
+                    return false;
+                }
+                if ($restriction->save()) {
+                    Notification::success(t('Restriction set'));
+                    return true;
+                }
+                return false;
+            })
+            ->setRedirectUrl('security')
+            ->handleRequest();
+        $this->view->name = $name;
+        $this->view->form = $restriction;
+    }
+
+    public function removeRestrictionAction()
+    {
+        $name = $this->_request->getParam('restriction');
+        if (empty($name)) {
+            throw new Zend_Controller_Action_Exception(
+                sprintf($this->translate('Required parameter \'%s\' missing'), 'restriction'),
+                400
+            );
+        }
+        $restriction = new RestrictionForm();
+        try {
+            $restriction
+                ->setIniConfig(Config::app('restrictions', true))
+                ->load($name);
+        } catch (InvalidArgumentException $e) {
+            throw new Zend_Controller_Action_Exception(
+                $e->getMessage(),
+                400
+            );
+        }
+        $confirmation = new ConfirmRemovalForm(array(
+            'onSuccess' => function (Request $request, ConfirmRemovalForm $confirmation) use ($name, $restriction) {
+                try {
+                    $restriction->remove($name);
+                } catch (InvalidArgumentException $e) {
+                    Notification::error($e->getMessage());
+                    return false;
+                }
+                if ($restriction->save()) {
+                    Notification::success(sprintf(t('Restriction \'%s\' has been successfully removed'), $name));
+                    return true;
+                }
+                return false;
+            }
+        ));
+        $confirmation
+            ->setRedirectUrl('security')
+            ->handleRequest();
+        $this->view->name = $name;
+        $this->view->form = $confirmation;
+    }
 }