Passwords of existing users not working. How to update?

Update: We were able to resolve this issue by adding this logic to the code:

If a user already exists, then update the password with the password the plugin expects.

So we changed line 58 at plugin file /lib/classes/saml_client.php

$this->simulate_signon($username);

to:

require_once(ABSPATH . WPINC . '/ms-functions.php');
	  $user_id = get_user_id_from_string( $username );
	  $newpass = $this->user_password($username,$this->secretsauce);
	  wp_set_password( $newpass , $user_id );
          $this->simulate_signon($username);

So glad that you ran into this problem just a day before me!! ?? I slightly improved your solution:

require_once(ABSPATH . WPINC . '/ms-functions.php');
           $user = get_user_by( 'login', $username );
           if($user)
           {
             $newpass = $this->user_password($username,$this->secretsauce);
             wp_set_password( $newpass , $user->ID );
           };
           $this->simulate_signon($username);

get_user_id_from_string is not found on my machine. The doc says it is deprecated and should be replaced by get_user_by…

Thanks for the improvement! We have updated our code with your version.

I’m glad to see this thread going and a solution posted. I tried both of the solutions posted, but neither resolves the issue.

If I delete the existing user completely and log in via my SSO, it works perfectly. WP creates the user and logs the user in.

If I put the user in place and then try either of theses fixes, the “ERROR: The password you entered for the username … is incorrect. Lost your password?” returns.

I did put in a few lines of code to see where the issue is. Authentication is entering into the if ($user) {} statement, but it seems like wp_set_password isn’t actually writing any changes for the user. Or if it is doing so, the new password being written is incorrect.

Any suggestions of how to troubleshoot it further?

To check whether wp_set_password is writing changes for existing users and check if this new value is correct – I did the following:

1. authenticate through SSO with a new user (e.g. user1)
2. change the username of this user into something else (e.g. user1check)
3. manually create the user you created trough sso (i.e. user1)
4. look at password hash of user1 in the db
5. authenticate through SSO
6. check if password hash has been changed for user1 (and if so: is it now the same as the password hash as user1check?)

If there is no change in the password hash, maybe you copy/pasted the suggested code in the wrong place or there’s a typo?

Or maybe you forgot to paste the
require_once(ABSPATH . WPINC . '/ms-functions.php');
into the code?

I followed those steps, and still had no success. The code isn’t touching the user records at all. Nothing is updated at all.

Here is a pastebin to what my saml_client.php file looks like.

I also tried putting the require_once in the function construct under the line 12 because I wasn’t sure if you hadn’t indented that line in order to indicate that it belongs elsewhere, like this:

require_once(constant('SAMLAUTH_ROOT') . '/saml/lib/_autoload.php');
require_once(ABSPATH . WPINC . '/ms-functions.php');

I tried to troubleshoot it a little further. Perhaps the wp_set_password is failing, but a lot of the WP functions don’t return a result. So it makes troubleshooting the issue a little more difficult.

The moment I delete the user and SAML in, everything is fine.

Any further suggestions?

Also, looking at the fix I realized that we’re calling a get_user_by inside of a get_user_by block that won’t trigger unless the user is already found.

if(get_user_by('login',$username))
{
  require_once(ABSPATH . WPINC . '/ms-functions.php');
  $user = get_user_by( 'login', $username );
   if($user)
   {
     $newpass = $this->user_password($username,$this->secretsauce);
     wp_set_password( $newpass , $user->ID );
   };
  $this->simulate_signon($username);
}
else
{
  $this->new_user($attrs);
}

This could all be condensed to this:

if($user = get_user_by('login',$username))
{
  require_once(ABSPATH . WPINC . '/ms-functions.php');
  $newpass = $this->user_password($username,$this->secretsauce);
  wp_set_password( $newpass , $user->ID );
  $this->simulate_signon($username);
}
else
{
  $this->new_user($attrs);
}

It still doesn’t work for existing users, but it is a cleaner solve.

Would there be anything wrong with that approach?

1. Maybe there is a plugin / theme conflict? Have you tried disabling all plugins and switching to standard theme and check if the problem still occurs?

2. Also: have you set correct permissions to the plugin files (i.e. executable by www-data/apache)?