Setting Password Complexity and Expiration Rules
Navigate to System Administration > Security > Password Policy to configure complexity requirements. The Password Policy form controls minimum length, character class requirements, and history depth stored in the SystemParameters table under the SECURITY parameter group. Set a minimum password length of 12 characters with at least one uppercase letter, one number, and one special character to meet NIST SP 800-63B guidelines.
Configure password expiration between 60-90 days with a history depth of 12 to prevent password recycling.
- Set MinPasswordLength to 12 characters in the Password Policy form to meet current NIST minimum recommendations
- Enable RequireUpperCase, RequireDigit, and RequireSpecialChar flags to enforce multi-class character requirements
- Configure PasswordHistoryDepth to 12 to prevent users from cycling through and reusing recent passwords
- Set PasswordMaxAge to 90 days for standard users and 60 days for users with elevated administrative access
Configuring Account Lockout and Failed Login Handling
Account lockout policies protect against brute-force attacks by disabling accounts after consecutive failed login attempts. In the Password Policy form, set the MaxFailedAttempts threshold to 5 and configure the LockoutDuration to 30 minutes. SyteLine logs all failed login attempts in the SecurityAuditLog table with timestamp, IP address, and username for forensic analysis.
For service accounts used by integrations, configure separate lockout rules with higher thresholds to prevent automated process disruptions.
- Set MaxFailedAttempts to 5 in the Password Policy form to lock accounts after five consecutive failed logins
- Configure LockoutDuration to 30 minutes for automatic unlock or set to 0 for manual-only administrator unlock
- Enable LoginAuditLogging to write all authentication attempts to the SecurityAuditLog table for compliance reporting
- Create a separate password policy for service accounts with a 15-attempt threshold to prevent integration disruptions
Integrating Multi-Factor Authentication
le Federation Services and third-party identity providers. 0 authentication and linking to providers like Azure AD, Okta, or Ping Identity. Once configured, users authenticate through the identity provider's MFA flow before SyteLine grants session access.
9% according to Microsoft security research.
- Enable SAML 2.0 authentication in the Infor Federation Services console and configure the SyteLine service provider metadata
- Map identity provider groups to SyteLine security groups using the Federation Group Mapping configuration
- Configure MFA enforcement policies to require second-factor authentication for all users or only privileged administrators
- Test the MFA login flow in a non-production environment before enabling in production to avoid user lockout scenarios
Try it here, free
SyteLine Multi-Site Replication Health Checklist
Configuration, data, service, queue and post-upgrade checks that keep SyteLine 9 and CSI 10 on-prem multi-site replication healthy.
Frequently asked questions
What happens when a SyteLine account gets locked out?
When an account exceeds the MaxFailedAttempts threshold, SyteLine sets the AccountLocked flag in the UserNames table and logs the event in SecurityAuditLog. If LockoutDuration is set to a value greater than 0, the account automatically unlocks after that many minutes. If set to 0, an administrator must manually unlock the account through the Users form by clearing the Account Locked checkbox.
Can I set different password policies for different user groups?
SyteLine applies a single global password policy by default through the SystemParameters table. However, you can implement group-specific policies by creating a custom event handler on the UserPasswordChange event that validates against group-specific rules stored in a custom UserDefinedTable. This approach requires moderate IDO customization effort, typically 8-12 hours of development work.
Does SyteLine support passwordless authentication?
SyteLine CloudSuite Industrial supports passwordless authentication through Infor Federation Services when configured with an identity provider that offers FIDO2, Windows Hello, or certificate-based authentication. Users authenticate through the external provider without entering a SyteLine-specific password. This requires CloudSuite Industrial version 10.2 or later and an Enterprise license for Federation Services access.
Need help hardening your SyteLine security posture? Netray's agents can audit your password policies and recommend configurations aligned with your compliance requirements.