Security
Security and user management are among the core system principles of the NET Genium platform. NET Genium is designed for enterprise applications where it is essential to clearly determine:
- who is working with the application,
- what data and functions they can access,
- what changes they performed,
- and when those changes occurred.
The platform also reflects current security standards and recommendations, especially methodologies of the OWASP Foundation.
Authentication and access security
NET Genium supports modern authentication approaches with a strong focus on security and enterprise integration.
- Sign-in using Microsoft accounts (Azure AD / Microsoft Entra ID) is supported.
- Multi-Factor Authentication (MFA) can be used to significantly increase access security.
- Authentication can be centralized and managed at the organizational level.
The use of MFA is a recommended standard, especially for applications working with sensitive or internal data.
Login to the portal
If a user enters an incorrect password when logging in, the system counts the invalid login attempts under the given login name within the last minute, hour and day. Depending on the number of these attempts, the following actions will be taken:
- After 3 invalid login attempts within one minute, the user will be blocked from logging in for 1 minute.
- After 9 invalid login attempts within one hour, the user will be blocked from logging in for 1 hour.
- After 18 invalid login attempts within 24 hours, the user will be blocked from logging in for 24 hours.
- A successful login does not reset the counter. A wrong second-factor code and a wrong original password in the form for changing an expired password also count as invalid attempts. Logins from the server desktop (IP address “127.0.0.1”) are never blocked.
- The periods are rolling: the block lasts until the oldest counted attempt leaves the given period, so the stated times are the longest possible. Login attempts made during the block are not counted; a wrong second-factor code is always counted. Invalid attempts from the server desktop and from IP addresses exempted from blocking are counted as well, and since blocking applies to the login name, they extend the block of logins from other addresses.
- Blocking applies to the login name, not to the IP address. An exception for administrators' IP addresses is enabled by the configuration file “DenyInvalidLogins.txt” described in the guide NET Genium settings.
Unblocking the account can be done by the system administrator by deleting the records of the user's failed logins in the invalid login table (Settings/Settings/Invalid Logins).
In case of a forgotten password, the user can reset his password by clicking on the “Forgot Password” link, if this option has been enabled by the administrator in the settings (see the option “Enable sending lost passwords on the login page” in the NET Genium settings guide). A single-use link valid for 1 hour arrives at the user's email address, and opening it lets the user set a new password; when no portal address is filled in, a temporary password with the same validity arrives instead, with which the user logs in and changes the password right away. A second e-mail then notifies the user that the change is complete.
If it is not possible to reset the password via the “Forgot Password” link, the user will contact the administrator to change the password, who will set a new password for the user (Settings/Settings/Users).
Users
NET Genium supports several types of users that differ in access method, level of permissions, and responsibility for performed changes. From the platform perspective, there are three basic user types:
- Standard user – works with application data and functions based on assigned permissions.
- Administrator – has access to all data and platform tools and creates or modifies applications using the integrated designer.
- Anonymous user – submits data through web forms embedded (typically via iframe) into web presentations.
Standard users and administrators always work within NET Genium under their own unique user account. Every action is traceable and linked to a specific identity.
Anonymous users do not enter the application as authenticated users. Their usage is limited to specific scenarios, typically data collection through public forms. In these cases, user identity and licensing of authenticated users do not apply.
Licensing model and users
The NET Genium licensing model is based on the maximum number of concurrently logged-in users.
- Each login of a standard user or administrator consumes one license; a member of the “External Users” group consumes an external license. An administrator is never refused a login in the web browser, not even when the licenses are exhausted.
- A user can log in multiple times under the same account, but still consumes only one license.
- A license is held by a user who has opened or submitted an edit form, a view page or the home page within the last hour. After an hour without such an action, the user is no longer counted as logged in, so the license of someone who closed the browser without logging out becomes available to others within an hour at most.
- The total number of licenses can be increased at any time according to organizational needs.
- Anonymous users do not require a license.
This model enables flexible application usage while maintaining clear control over resource utilization.
Permissions, user groups, and rights groups
User access to applications, data, and functions in NET Genium is controlled using permissions. Each building block of the platform (application, edit form, view page, control, and other objects) allows independent permission configuration. Permissions can be assigned to:
- user groups,
- or individual user accounts.
Since a user can belong to multiple user groups, manual assignment may become unclear or error-prone when creating new users. For this reason, NET Genium supports rights groups. A rights group represents a predefined set of user groups corresponding to a typical user role within an application. Within user account settings, a specific rights group can be selected. In such a case, the user's assigned groups are replaced by the set defined in the selected rights group. Changing the rights group is subject to the same checks as a manual change of the user group list. The list of user groups assigned to a user can still be adjusted manually if needed; in the user form, it is displayed to administrators, user account administrators, and users with the permission to change group membership.
The default NET Genium installation includes these system user groups:
- Users – standard users
- Administrators – administrators
- External Users – external users who consume external licenses; the group is not created in NET Genium Online
Using user groups is the recommended approach for long-term application management.
History and audit trail
One of the key features of NET Genium is the automatic tracking of change history. Every data change in the application:
- is assigned to a specific user,
- includes a timestamp,
- is traceable retrospectively.
The audit trail ensures transparency of data operations, supports internal control mechanisms, and enables retrospective analysis of changes. History is not only for troubleshooting but is a fundamental tool for responsible management of enterprise applications.
Security testing and updates
The security of the NET Genium platform is continuously verified and improved.
- During the launch of larger projects, penetration testing of the entire framework is performed.
- Identified issues are resolved through centralized updates, which are distributed to all application instances.
- Security and functional updates of the framework are released regularly.
This approach ensures that all platform installations continuously meet current security requirements.
Security standards
The platform is designed and developed in accordance with the principles and recommendations of the OWASP Foundation (Open Worldwide Application Security Project). This includes in particular:
- protection against common attack types (e.g., injection, XSS, CSRF),
- secure handling of authentication and sessions,
- input validation and sanitization,
- emphasis on secure application architecture design.
Adherence to these principles is essential for the secure operation of enterprise applications in NET Genium.
Administrator responsibility
The application administrator is responsible for the correct configuration of security principles within a specific solution. This includes in particular:
- user account management,
- design and maintenance of permissions,
- control of access to sensitive data,
- regular review of settings,
- use of security mechanisms such as MFA.
A properly designed security structure protects not only data but also users and the organization as a whole.