8

A significant minority of our users repeatedly experience login failures and have to reset their passwords every time. Can anyone suggest possible solutions please? Details as follows.

Apparently, the behaviour is as follows:

  • User opens login page, enters valid username and password.
  • Login fails, repeatedly!
  • User requests password reset. Then, using link from e-mail able to: reset password, login and access their account
  • Next login, user has to repeat process.

Unfortunately, we can't duplicate the issue ourselves. But we have looked through Drupal logs and Apache access logs and observed the following:

  • The problem is not confined to a specific browser (seen on IE, Safari, Firefox) nor a specific OS (seen on Windows, Mac, iPad)
  • The users do generally have cookies turned on. We have inserted some custom code to warn users with cookies turned off and write "cookies disabled" to Drupal logs.
  • Clearing all caches in Drupal doesn't fix issue.
  • Clearing cookies in browser doesn't fix issue either, one of our users has tried.

We are running Apache on an Ubuntu server.

In settings.php, $base_url is commented out; $cookie_domain is also commented out. It was set, but we decided it was safer to remove it although, I'm not sure that made any difference.

We are using "Profile2" and "Profile2 Registration Path" modules. However, I doubt those modules are the source of our problems as I cannot find any record of anyone else having login problems with those modules.

Do you have any suggestion?

I should have mentioned, the site is running Drupal 7.13.

When the user clicks on the password reset link they are currently prompted to change their password.

We have also asked one user to try another browser but sadly, that didn't fix their problem. Also we have noticed that the problem on IE, Firefox & Safari so, we don't think it's browser specific

Improve this question
4
  • 1
    +1, good question. I have had the same problem, but couldn't reproduce the error in my local environment.
    – Cyclonecode
    Commented Dec 17, 2012 at 2:27
  • your version of drupal would be helpful.
    – user2948
    Commented Dec 17, 2012 at 8:28
  • I know this seems like a silly question, but are you sure the username/password entered by the users are valid? Maybe try this… After they use the password reset link, instruct them to immediately change their password on the account page that appears (this form does not require the existing password to change the account password). See if the problem persists for that user. Alternatively, see if they can log into the account from another browser/computer.
    – thirdender
    Commented Dec 19, 2012 at 8:06
  • Do the users that experience problems comes from the same domain? Do they have a firewall, proxy, etc?
    – Cyclonecode
    Commented Dec 20, 2012 at 16:43

3 Answers 3

Reset to default
3

Not meaning to dig up an old thread, just trying to help anybody who finds it - we had the exact issue described here, on two occasions, on two sites. We finally figure it was caused by users trying to log in with their email address instead of their username, which is why they are able to reset the password but not log in.

Improve this answer
2

I would ask one of the people who has had this problem to work through it with you. Do a skype screenshare or look over their shoulder while they experience the problem.

In my experience, these people are not clicking "save" after entering a new password so their password isn't actually getting changed.

Improve this answer
1
  • It seems this is the more plausible explanation, especially considering the number of users with an account on a Drupal site.
    – avpaderno ♦
    Commented Dec 21, 2012 at 7:30
0

Perhaps your users are being flood-locked. Too many unsuccessful logins will cause the user to be blocked. A less-well-known feature is that too many unsuccessful logins from a given IP will cause a user to be blocked. This is set to 50 failed attempts per hour by default.

So if you have a lot of users accessing via a single IP (maybe they're on a company network) then a few people forgetting their passwords can inadvertantly lock each other out. The next time you get this problem it would be interesting to take a look at the flood table to see if they're locked.

To test this, you could also increase the flood lock values user_failed_login_ip_limit and user_failed_login_ip_window. There's no UI for this in core but the Flood Control module provides one. Or you can easily set the value from drush or in your settings.php file.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.