Every so often, my users get logged out, and are unable to log back in without doing the "forgot your password" thing (which works fine). I've put some watchdog statements into core to try to see what's going on, and, while I'm hardly expert in the ins and outs of the Drupal login process, I can tell that, in _password_crypt()
, down in password.inc, things make it all the way through to the comparison of the hashed entered and stored passwords, where it fails. This is perhaps because, in checking the database, the users' values for PASS have changed relative to what I saw there when the users were able to log in successfully.
Some other details:
Yes, I'm up to date on patches (Drupal 7.15, and up-to-date versions of contrib)
System and browser caches have been cleared multiple times.
The site is under apache-level password control, and I've confirmed from the log files that nobody from the outside world is sneaking in. So there's no funny business there.
There don't seem to be any exact time aspects to this, but I can typically run, stay logged-in for a day or so before getting logged out.
I'm running the Twitter Bootstrap theme, and I am also using the Less module for CSS generation. Both seem to work fine.
I've experimented with setting
$base_url
and$cookie_domain
in the settings file; neither seem to have much effect on the problem, either set or unset.Because of the watchdog statements I added (see above), I've been able to see that
_password_crypt()
is running at times when I wouldn't have expected it to be running (like, not in response to a user's logging in). Checkinguser->pass
in the database, I found that at least one of the users' entries was no longer what it was after the user set the password after getting logged in through the login link. When this happened, that user was still logged into a browser, and he was still able to function as that logged-in user. However, once he logged out, he couldn't log back in without requesting a new password. More system tracing is underway.
This is seriously killing me; I've worked with Drupal a lot, and have never seen anything like this. Can anybody offer some thoughts on this?
_password_crypt()
is used to verify the password entered during login is the correct one; the function generates the password hash, which is what Drupal stores in the database.