This issue happened on my  localhost machine while in development but I thought nothing of it since I had multiple drupal projects and was jumping to one another constantly - I figure it was cookies or what not and was constantly resetting my passwords. However I recently went into production and this issue is still occuring.  I have a new drupal site for which I created 2 new users for testing purposes. I realized that after 24 hours or so, the login credentials for these users would not work and I would get :     Sorry, unrecognized username or password. Have you forgotten your password?   I use these accounts to log in via browsers other than my main one and test the user interface of my production site. After each use I make sure I logout.  I made sure to configure the  $cookie_domain in my settings.php and chmod the file properly but the issue still occurs.  Recently I started tracking the hashes in the user table and low and behold they are magically changing without any human intervention ! What can be causing that ?  Oddly enough, this issue does not happen with the admin account (#1) for which I have yet to logout, and another account which was created but never used. In both cases user_check_password() returns true.  Clearing cache does nothing.  I am running the latest core with latest version of all contrib. modules. I use SSL everywhere I have APC and memcache running. I use a mix of MongoDB and MySQL
121119
I have a function that sets a user to confirmed after they login to my site for the first time. However, whenever I run this function and I log out and try to log back in the password doesn't work anymore and I have to do a manual reset in the database. I can't seem to find what would cause a change in the password. Any advice?  Note that I am using mongodb.  function update_profile($uid,$attribute_name,$attribute_value,$arrayaction=NULL) {     // update some user property     $existing = user_load($uid);     $edit = (array) $existing;      //Update profile iformation     if(!empty($arrayaction))     {         if(strtolower($arrayaction) == 'push')         {             array_push($edit[$attribute_name]['und'][0],$attribute_value);         }         else if (strtolower($arrayaction) == 'unset')         {             if(($key = array_search($attribute_value, $edit[$attribute_name]['und'][0])) !== false) {                unset($edit[$attribute_name]['und'][0][$key]);             }         }     }     else     {         $edit[$attribute_name]['und'][0] = $attribute_value;     }      //Make the changes to the user     user_save($existing, $edit); }  function module_user_login(&amp;$edit,$account) {     if ($account-&gt;access == 0) {         update_profile($account-&gt;uid,'field_confirmed',array('value'=&gt;1),NULL);     } }
88008
If I enter my password correct first time, I login as normal.  If I enter my password wrong, it says invalid password. If I attempt to enter the correct password now then the screen freezes and doesn't go to dock as normal. I must restart using a physical button or shutdown to get out. Login works normally after restart, assuming I get it right first time.  EDIT:  After entering a wrong password, if I click cancel and then go back to my user to login, it works fine.
8567
I can't login My drupal website (D 7.23) now. I have changed the password and tried to login back, but still the problem exists. After I reset the password by using the one time password and can log in, but when we log out and try again to login, it will be a failed one.  Please help me to solve it.
50203
I just recently copied a Drupal 7 site from one server to another, everything looks like it works fine except that I cannot save any settings.  Here are some other symptoms:   I can't disable or enable modules Overlay doesn't work Once I log out, I can't log back in When trying to log back in with the wrong criteria, I don't get a message about the user/pass being wrong admin_toolbar doesn't work (except immediately after clearing cache via drush) Status report doesn't show anything being wrong   I've got varnish running on the server and I'm not quite sure if that would have anything to do with it.
98275
If I go to e.g.  while logged in at Data.SE, the ##UserId## parameter isn't populated like it usually is. This was originally only happening for some sites, but now it seems to be happening for all of them.
12804
The Setup:  1) The user's password was deleted with "passwd -d " command  2) The user has cron jobs running  The Problem: Once every 30 days (default password expiration policy) the cron fails with an error  Authentication token is no longer valid; new one required ERROR: failed to open PAM security session: Success ERROR: cannot set security context   My Questions: Is there a way to prevent this from happening? Why is the authentication token expired for a user with deleted password?
63495
Is there any possibility to Re-Authenticate user especially on specific pages like we see in some websites?  Background: for some of the websites like banking sites, when you are initiated fund transfer it will ask you to re-authenticate your account. Main moto is here, user will be logged in a long back ago using "Remember me", so for visiting few pages I want to re-authenticate user.
59266
Ever since I changed my user account password, every time I log in to my machine I have to enter multiple passwords. First, I enter the new account password to actually log in. Once I'm at my desktop I get prompted to enter a few other passwords too. Namely the following:      My old password is required to successfully dismiss all of the above pop-ups. Is there some way of updating anything in my keychain that still uses the old password, to use the new password?  Any ideas what could have caused this? I can only imagine that the intended behaviour is for this update to happen automatically.
115664
It asks for login profile name and then password. Is it some kind of problem or it looks that way?
31361
Is there a way to configure a password for a stored session in ?  I know there is the capability to specify an "auto-login username" (under Connection/Data), but is there a way to do the same with the password?
45687
Apparently, for some reason, . I got this notice while logging in with Disqus, but not with Stack Exchange.  So... is Stack Exchange going to be affected by this? Do I need, or want, to add extra login methods to my Stack Exchange account to ensure I can still log in come April?
1987
Every time I log in from a shared computer on Stack Overflow, I am not able to log out.  Even if I click log out, it takes me to the home page and when I click the login link it automatically logs me back in. I neither allow my browser to save passwords or nor to remember me.  I get this message each time     Welcome back user. Click here to refresh the page   Each time I have to clear all my cookies from my browser to log out from it. Why does this happen?
56748
on one of the boxes I don't control at work I use ssh keys to log in. Our passwords are set to expire after a few months. What happens if I don't reset my password and it expires? will I still be able to login? Does what happens depend on some sshd setting? or some pam setting?
59542
I've seen this behavior on multiple meta sites, for example:        As soon as you choose to add a new login (To be honest I only tried Google, Facebook and the OpenId box), you get redirected to a 404 page at [meta site url]/users/authenticate. .  In my opinion, since when trying to login (i.e. first time login) on a meta site it redirects to the login page of its main, the "Add more logins" page on meta should also redirect to its main "add more logins" page. I think this would just make it more consistent.
104897
I was auto-logged out from the chat.stackexchange.com server. And I couldn't log back in! I reproduced this issue both on Chrome 67 and on Firefox 61, both with regular tabs and Private / Incognito tabs. My OS is macOS 10.13.5.  What I tried:   on chat.stackexchange.com, click the 'login' button (top right, next to the search box). click the log in with Stack Exchange button. fill in my Stack Exchange login credentials. I'm redirected to https://stackoverflow.com/users/login?teamsMember=1, a page that tells me with a red box that I need to log in directly, since I'm a team member:   Fill in my credentials again. Now I'm logged in to Stack Overflow. Return to chat.stackexchange.com, confirm I am not logged in there. Try the same flow again. Log in link, use log in with Stack Exchange, fill in credentials. Now I am taken to a page on Stack Overflow that states I am logged in, and asks me to add another way to log in?     So the log in flow wants me to log in on Stack Overflow, and that log in is never reflected back to Stack Exchange. I can't log in on https://stackexchange.com either. On step 3 I can also use my OpenID URL (which is backed by the Stack Exchange OpenID service for now until I can figure out how to rescue my SEDE account queries) but this has the exact same result.  The work-around is to log into  (or any one of the other *.stackexchange.com sites, such as ), then suddenly chat has me logged in as well, and  acknowledges my account exists too.
43239
Recently, My SSH log summaries for my Ubuntu 12.04 servers in Logwatch have started showing entries for "11: Normal Shutdown, Thank you for playing [preauth]" along with the "11: Bye Bye [preauth]" and "11: disconnected by user" messages they had been showing previously.  I have not seen this message in my logs before the past few weeks, nor have I seen it on my older servers which are stuck on Ubuntu 10.04. I have googled this message and can't find any clear explanations there either.  The IPs attempting to login and receiving this message are random hack attempts, and judging from the preauth I assume (hope) they are not successful, but I would like to know exactly what this message means and how it differs from others to be sure.  EDIT for additional information: My servers have password authentication and root authentication both disabled
33850
I haven't logged onto my blog for years, and have, of course, forgotten the password. I click the 'Forgot' button and get a mail with a link, but that mail already says     Sorry, that key does not appear to be valid.   And sends me round the click to reset, receive a mail, click the link again etc. As if the timeout for password resets has been set to 0.5s or something.  This is a shared hosted blog, so I have full access to cPanel and all of the WP files via FTP, if that helps anything.