Security and users

Security

Security and user management are among the core system principles of the NET Genium platform. NET Genium is designed for enterprise applications where it is essential to clearly determine:

• who is working with the application,
• what data and functions they can access,
• what changes they performed,
• and when those changes occurred.

The platform also reflects current security standards and recommendations, especially methodologies of the OWASP Foundation.

Authentication and access security

NET Genium supports modern authentication approaches with a strong focus on security and enterprise integration.

• Sign-in using Microsoft accounts (Azure AD / Microsoft Entra ID) is supported.
• Multi-Factor Authentication (MFA) can be used to significantly increase access security.
• Authentication can be centralized and managed at the organizational level.

The use of MFA is a recommended standard, especially for applications working with sensitive or internal data.

Login to the portal

If a user enters an incorrect password when logging in, the system counts the invalid login attempts under the given login name within the last minute, hour and day. Depending on the number of these attempts, the following actions will be taken:

• After 3 invalid login attempts within one minute, the user will be blocked from logging in for 1 minute.
• After 9 invalid login attempts within one hour, the user will be blocked from logging in for 1 hour.
• After 18 invalid login attempts within 24 hours, the user will be blocked from logging in for 24 hours.
• A successful login does not reset the counter. A wrong second-factor code and a wrong original password in the form for changing an expired password and in the “Change password” dialog also count as invalid attempts. While the user name is blocked, the “Change password” dialog rejects the password change. Logins from the server desktop (IP address “127.0.0.1”) are never blocked.
• The periods are rolling: the block lasts until the oldest counted attempt leaves the given period, so without further counted attempts it lasts the stated time at most. Login attempts made during the block are not counted; a wrong second-factor code is always counted. Invalid attempts from the server desktop and from IP addresses exempted from blocking are counted as well, and since blocking applies to the login name, they extend the block of logins from other addresses.
• Blocking applies to the login name, not to the IP address. An exception for administrators' IP addresses is enabled by the configuration file “DenyInvalidLogins.txt” described in the guide NET Genium settings.
• Blocking applies only to logins with a login name and password, including logins through the web services of the “NETGeniumConnection” library. Signing in through Microsoft, Google, Facebook or Apereo, through Windows Integrated Authentication or with a login ticket, as well as access with a token through the integrated MCP server and through a custom API, is not restricted by a blocked login name.

Unblocking the account can be done by the system administrator by deleting the records of the user's failed logins in the invalid login table (Settings/Settings/Invalid Logins).

In case of a forgotten password, the user can reset his password by clicking on the “Lost password” link, if this option has been enabled by the administrator in the settings (see the option “Enable sending lost passwords on the login page” in the NET Genium settings guide). A single-use link valid for 1 hour arrives at the user's email address, and opening it lets the user set a new password; when no portal address is filled in, a temporary password with the same validity arrives instead, with which the user logs in and changes the password right away. An unused link and a temporary password are also invalidated by every successful login of the user in the browser or through the Login.aspx page. A second e-mail then notifies the user that the change is complete.

If it is not possible to reset the password via the “Lost password” link, the user will contact the administrator to change the password, who will set a new password for the user (Settings/Settings/Users).

Users

NET Genium supports several types of users that differ in access method, level of permissions, and responsibility for performed changes. From the platform perspective, there are three basic user types:

• Standard user – works with application data and functions based on assigned permissions.
• Administrator – has access to all data and platform tools and creates or modifies applications using the integrated designer.
• Anonymous user – submits data through web forms embedded (typically via iframe) into web presentations.

Standard users and administrators always work within NET Genium under their own unique user account. Every action is traceable and linked to a specific identity.

Anonymous users do not enter the application as authenticated users. Their usage is limited to specific scenarios, typically data collection through public forms. In these cases, user identity and licensing of authenticated users do not apply.

Licensing model and users

The NET Genium licensing model is based on the maximum number of concurrently logged-in users.

• Each login of a standard user or administrator consumes one license; a member of the “External Users” group consumes an external license and, if they are in three or more user groups in total (counting the “External Users” group), also a standard license. An administrator logging in to the web browser with administrator privileges is never refused a login, not even when the licenses are exhausted; an administrator logged in without them, because their IP address does not match the allowed IP addresses of the “Administrators” group, cannot log in when the licenses are exhausted.
• A user can log in multiple times under the same account, but still consumes only one license.
• A license is held by a user who has logged in or opened or submitted an edit form, a view page, the home page or an e-learning page within the last hour, and by a login with a token through the integrated MCP server or a login through the web services of the “NETGeniumConnection” library that has sent a request within the last hour. After an hour without such an action, the user is no longer counted as logged in, so the license of someone who closed the browser without logging out becomes available to others within an hour at most. Licenses are checked only at login, so a user who returns after more than an hour of inactivity to a session that has not expired yet keeps working even if someone else has used their license in the meantime.
• The total number of licenses can be increased at any time according to organizational needs.
• Anonymous users do not require a license.

This model enables flexible application usage while maintaining clear control over resource utilization.

The license key is issued by NetGenium, and NET Genium reads it from the “Config\license.txt” file. The key is issued for the MAC address of the server, sets the number of licenses and may also contain:

• the number of external licenses – how many members of the “External Users” group may be logged in at the same time; without them, a member of this group cannot log in,
• the validity date – during the last 14 days before it, NET Genium displays a warning in the header; after the date, the key remains valid for one more week and the header counts down the time until the switch to the mode without a license,
• the database name – the key is then valid only with a database of that name; the name is compared regardless of letter case with the “Database” or “Initial Catalog” value of the connection string, so with MS SQL Server it is the database name and with Firebird the path to the database file or its alias – after the database file is moved to another path, the key stops being valid,
• permission for artificial intelligence – without it, the integrated MCP server cannot be used; it is not required in NET Genium Online.

Without a valid license key, NET Genium runs without a license: the browser window title shows “NO LICENSE”, a warning is displayed in the header (with an expired key to all users, otherwise only to the built-in “Administrator” account), and view tables and other controls load at most 100 records from a row query. If the key file is missing, the key cannot be read or the MAC address of the server does not match, only one user and no member of the “External Users” group may be logged in; with a key issued for another database or with an expired key, the number of licenses stays as stated in the key. NET Genium writes the reason why the key is not valid to the “System” log at startup, after the key is uploaded or activated in the license key request dialog, and when the key expires while the application is running. Licenses are not enforced in NET Genium Online.

A license key is requested in the “License key request” dialog (“New license key request” when a valid key exists), which only the built-in “Administrator” account opens from the toolbar in the navigation area in admin mode. The “Generate a request” button prepares an e-mail message with an encrypted request for download, which contains, among other things, the MAC address of the server and the database name; the message has to be sent to support@netgenium.com. The key received is uploaded in the same dialog as a text file whose name starts with “license” and ends with the “.txt” extension regardless of letter case (typically “license.txt”; the dialog rejects a file with any other name, a file whose content is not a readable license key, and a key that is not valid for this server – issued for another MAC address (checked only when the server knows its MAC address) or another database, or expired more than a week ago –, with the message “Invalid license key!” and keeps the existing key; except for a file with another name, the reason for the rejection is written to the “System” log), or a key copied into the “Config\license.txt” file is applied with the “Activate license key” button – in both cases it takes effect immediately, without a restart, in the web application process that received it; if more processes run over the same database, the others pick it up within an hour when the portal header is rendered if the previous key has an expiration date, otherwise only after a restart.

Permissions, user groups, and rights groups

User access to applications, data, and functions in NET Genium is controlled using permissions. Each building block of the platform (application, edit form, view page, control, and other objects) allows independent permission configuration. Permissions can be assigned to:

• user groups,
• or individual user accounts.

The “Administrators” user group, the “Administrator” user account, and the individual user accounts of the members of the “External Users” group are not offered in the rights lists of the configuration dialogs; external users can be included in rights through a user group.

Since a user can belong to multiple user groups, manual assignment may become unclear or error-prone when creating new users. For this reason, NET Genium supports rights groups. A rights group represents a predefined set of user groups corresponding to a typical user role within an application. Within user account settings, a specific rights group can be selected. In such a case, the user's assigned groups are replaced by the set defined in the selected rights group. Changing the rights group is subject to the same checks as a manual change of the user group list. In the “User group” form, where the list of group members is edited, only the “Administrators” group is checked, whose members may be changed only by the user “Administrator”, and the “Users” group, whose members may be changed only by a user with administrator privileges or a user account administrator; members of other groups may be changed by anyone who sees the list of members and may edit the group record. The list of user groups assigned to a user can still be adjusted manually if needed; in the user form, it is displayed to administrators, user account administrators, and users with the permission to change group membership. This permission is set by an administrator in admin mode with the “Modify...” icon next to the list of user groups in the “User” or “Rights group” form, or next to the list of users in the “User group” form; user groups or users are selected for it, and it applies to all three forms together.

A change of the user groups of a user (including the “Administrators” group, and therefore also of administrator privileges) does not take effect in the session in which the user is currently logged in in the web browser – it applies only after the user logs in again. The exception is saving one’s own record in the “User” form, after which the session in which the record was saved is refreshed; other sessions of the same user (for example in another browser) are not. If the user is to lose access immediately, the user’s sessions must be logged out in the list of online users. Deleting the user also ends all of the user’s logged-in sessions. If several processes of the web application run over the same database, or if the user is deleted by an external function or a service through the “NETGeniumConnection” library, a logged-out session served by another process is blocked only on the main page or a view page or when an edit form is opened – not in a configuration dialog and not when a form is saved.

The default NET Genium installation includes these system user groups:

• Users – standard users
• Administrators – administrators
• External Users – external users who consume external licenses; the group is not created in NET Genium Online

Using user groups is the recommended approach for long-term application management.

History and audit trail

One of the key features of NET Genium is the automatic tracking of change history. Every data change in the application:

• is assigned to a specific user,
• includes a timestamp,
• is traceable retrospectively.

The audit trail ensures transparency of data operations, supports internal control mechanisms, and enables retrospective analysis of changes. History is not only for troubleshooting but is a fundamental tool for responsible management of enterprise applications.

Security testing and updates

The security of the NET Genium platform is continuously verified and improved.

• During the launch of larger projects, penetration testing of the entire framework is performed.
• Identified issues are resolved through centralized updates, which are distributed to all application instances.
• Security and functional updates of the framework are released regularly.

This approach ensures that all platform installations continuously meet current security requirements.

Security standards

The platform is designed and developed in accordance with the principles and recommendations of the OWASP Foundation (Open Worldwide Application Security Project). This includes in particular:

• protection against common attack types (e.g., injection, XSS, CSRF),
• secure handling of authentication and sessions,
• input validation and sanitization,
• emphasis on secure application architecture design.

Adherence to these principles is essential for the secure operation of enterprise applications in NET Genium.

Administrator responsibility

The application administrator is responsible for the correct configuration of security principles within a specific solution. This includes in particular:

• user account management,
• design and maintenance of permissions,
• control of access to sensitive data,
• regular review of settings,
• use of security mechanisms such as MFA.

A properly designed security structure protects not only data but also users and the organization as a whole.