Call to JFactory::getApplication()->login changes user's password

Question

I have followed this tutorial to create a component in Joomla 2.5.19. I have modified the code a bit to suit my needs. I have changed

$response = $auth->authenticate($credentials, $options);

to

JFactory::getApplication()->logout(null, $options);
$authorized = JFactory::getApplication()->login($credentials, $options);

But this call to login changes user's password. Does any one have any clue, why it is behaving like this.

Note: I have also installed latest version of JomSocial.

Thanks,

Answer 1

The password itself is not changing, what is happening is that the method hashing of the password prior to storing in the the database has changed. Users with existing passwords with the old hashing have their hashing changed when they login. If you use the JUser API with your authentication system this will work seamlessly, you would only know that it happens if you look in the database.

Answer 2

I only briefly reviewed the link you posted with the tutorial, and from first glance this is not the correct way to achieve external authentication in Joomla. You should write an authentication plugin which hooks into core events and seamlessly integrated with the framework.

Although you could most definitely make this approach "work," in the long run, by working against the framework; maintaining the code could become more and more difficult.

The link below is for Joomla 3.2, but the concepts apply. I would recommend reverse engineering existing core authentication plugins.

If you choose to continue with the component approach check out the com_users login controller and model for his they handle login posts. Both should have relevant methods.

http://docs.joomla.org/J3.2:Creating_an_Authentication_Plugin_for_Joomla

Answer 3

I figured it out with the help of Elin...

Turned out to be a rehash... In Joomla 2.5.19, (libraries/joomla/user/helper.php) JUserHelper::verifyPassword() is actually rehashing and updating the password in database.

Thank you @Elin. Can you submit you comment as answer so I can accept it :)