Bizarre wp_signon problem

Question

Very odd problem with wp_signon

Below I pass a users credentials to wp_check_password and it returns true proving the password is correct.... however when i try to signin it return wp_error with
"ERROR: The password you entered for the username XXXXXXX is incorrect."

Please, can anybody explain why this is? and how to fix?

---

$password = "vdouW#DswYMH"
$hashed = wp_hash_password($password);   //$P$Bydu8uFLe8CFXmtGjA71Tfv8Tyo7nH0

if (wp_check_password($password,$hashed,$user->data->ID)) {
    echo "Yes, password correct".
    $creds['user_login'] = $user->data->user_login;
    $creds['user_password'] = $password;
    $creds['remember'] = false;
    $user2 = wp_signon( $creds, true );

    if ( is_wp_error($user2) )
        echo $user2->get_error_message().' - '.$hashed;
    else
        echo 'Success<br/>';
}

Answer 1

Pretty sure wp_check_password() is not meant to be used the way you're using it.

From the looks of the documentation, and as far as I can tell by looking at the source, this function is only meant to compare the plaintext password you provide against the hash you provide--not to check whether a particular user's stored password matches the passed creds. (The user id param is misleading--it has to do with converting a user's existing password form one kind of hash to another when necessary, I believe. But I'm not 100% sure).

In any case, you don't need to do any of this checking manually. The wp_signon() function will itself will check the creds, and if they're correct it'll log the user in and pass back a valid user object. If the creds aren't right, it'll pass back an error object.

Answer 2

What function are you adding your users with? I just ran into a fail in wp_update_user (3.1), resulting in wp_signon failing because password had been stored double-hashed. Using wp_insert_user seems to operate correctly.