warning: Error saving user id {id} password after rehashing: identifier Password not found. Check your Auth.PasswordRehash.identifiers configuration.

[Murl080]

After upgrading to CakePHP 5.x and CakeDC users plugin 16.0.0, we get the following warning:

2026-01-28 14:00:15 warning: Error saving user id 1 password after rehashing: identifier Password not found. Check your Auth.PasswordRehash.identifiers configuration.

The line triggering this warning is:
https://github.com/CakeDC/users/blob/16.0.0/src/Controller/Component/LoginComponent.php#L196

The reason for this warning is that the CakeDC users plugin default configuration contains deprecated configuration:
https://github.com/CakeDC/users/blob/16.0.0/config/users.php#L287

According to the code https://github.com/CakeDC/users/blob/16.0.0/src/Controller/Component/LoginComponent.php#L206-L207
the new way should have configuration set under Auth.PasswordRehash.authenticators

[LordSimal]

We are also running into this issue.

[LordSimal]

I tried adjusting the config to what is proposed in that commit, but it doesn't change/fix the problem

[steinkel]

A fix was provided by @arodu to handle the warning, merged into 16.next-cake5, would you be so kind to check if the warning is gone to release a patch version? Thank you

[Murl080]

@steinkel I now get this warning:
2026-02-13 13:42:05 warning: Error saving user id {id} password after rehashing: identifier Authentication.Password not found. Check your Auth.PasswordRehash.authenticators configuration.
I'm guessing this is because the dot in the identifier Authentication.Password is interpreted as a seperator in the config so it cannot find that exact config.

[arodu]

Hi @Murl080
In the authenticators config, do you have the identifier Authentication.Password configured?

        'Authenticators' => [
            'Form' => [
                'className' => 'CakeDC/Auth.Form',
                'urlChecker' => 'Authentication.CakeRouter',
                'identifier' => [
                    'Authentication.Password' => [
                        'fields' => [
                            'username' => ['username', 'email'],
                            'password' => 'password',
                        ],
                        'resolver' => [
                            'className' => 'Authentication.Orm',
                            'finder' => 'active',
                        ],
                    ],
                ],
            ],

[Murl080]

@arodu Yes we do.

We slightly adjusted the orignial configuration. We only use the email field for the username field, the rest is unchanged.

The issue seems to be that the loaded name for the password identifier is not Authentication.Password but simply Password

[arodu]

@Murl080 I'd like to look into this issue and try to reproduce it locally.
To help me debug this, could you please provide the following details?

• Environment: PHP version, CakePHP version, and the exact version of the cakedc/users plugin you are using.
• Steps to reproduce: The specific actions, URLs, or data submitted that trigger the error.
• Configuration: Any relevant settings from your users.php or app.php files.

[Murl080]

@arodu
Environment:

Steps to reproduce: I simply log in with valid user data, the data submitted is the email and password

Configuration:
users.php

<?php

use CakeDC\Auth\Authentication\DefaultU2fAuthenticationChecker;
use Cake\Core\Configure;

// Auth config sub key "Authentication.Password" cannot be overwritten due to dot notation
Configure::delete('Auth.Authenticators.Form.identifier');

return [
    'Users.config' => ['users'],
    'Users.RememberMe.active' => false,
    'Users.table' => 'Users',
    'Users.controller' => 'Users',
    'Users.Registration.defaultRole' => 'U',
    'Users.Email.mailerClass' => 'Users',
    'Users.Email.validate' => true,
    'Users.Profile.route' => '/',
    'U2f' => [
        'enabled' => false,
        'checker' => DefaultU2fAuthenticationChecker::class,
        'startAction' => [
            'plugin' => 'CakeDC/Users',
            'controller' => 'Users',
            'action' => 'u2f',
            'prefix' => false,
        ],
    ],
    'Auth' => [
        'loginAction' => [
            'plugin' => false,
            'controller' => 'Users',
            'action' => 'login',
            'prefix' => false,
        ],
        'flash' => [
            'element' => 'error',
            'key' => 'auth',
        ],
        'Authenticators' => [
            'Form' => [
                'identifier' => [
                    'Authentication.Password' => [
                        'fields' => [
                            'username' => ['email'],
                            'password' => 'password',
                        ],
                        'resolver' => [
                            'className' => 'Authentication.Orm',
                            'finder' => 'active',
                        ],
                    ],
                ],
            ],
        ],
    ],
    'Auth.Identifiers.Password.resolver.finder' => 'auth',
    'Auth.Identifiers.Social.authFinder' => 'findAuth',
    'Auth.Identifiers.Token.resolver.finder' => 'findAuth',
    'Auth.Identifiers.Password.fields.username' => 'email',
    'Auth.Authenticators.Form.fields.username' => 'email',
];

[steinkel]

we've applied a small fix, just merged into 16.next-cake5. @Murl080 if you are so kind to check it's working for you too, we'll release a patch next. Thanks,

[Murl080]

@steinkel The issue seems to not happen for me anymore with the same configuration and action, thank you for the fix and your time.