Magento2 multi website / store - Admin created customers are redirected to wrong store after password create & login

Question

This is a Magento CE 2.2.5 project

We've found bug, reported here https://github.com/magento/magento2/issues/20148

Steps to reproduce

• Create new customer in admin with associated website / store different than default store
• Welcome mail with a link to "create password" feature is then sent to new customer
• Create password works fine, and the customer is redirected to associated store login page

Expected result

• After login, customer should be redirected to homepage (or dashboard, if configured... or any other page) of associated store

Actual result

• After login, customer is redirected to homepage of default store

We've tried to fix this by forcing the right redirect with a plugin approach (afterExecute in \Magento\Customer\Controller\Account\LoginPost) & observer approach (controller_action_postdispatch_customer_account_loginPost event) but it still redirected to default store homepage

It seems this doesn't occur in 2.2.7 or higher versions. Any ideas to fix this without having to update the whole application?

Answer 1

As a workaround for this, we are rewriting Magento\Customer\Model\AccountManagement resetPassword(), setting customer as logged in at the end of that function, this way the flow doesn't reach the point where redirect bug occurs

class AccountManagement extends \Magento\Customer\Model\AccountManagement
{

    /** Need to copy here, cause of private scope */
    private function validateResetPasswordToken($customerId, $resetPasswordLinkToken)
    {

        $customerRegistry = ObjectManager::getInstance()->get(\Magento\Customer\Model\CustomerRegistry::class);
        if (empty($customerId) || $customerId < 0) {
            throw new InputException(
                __(
                    'Invalid value of "%value" provided for the %fieldName field.',
                    ['value' => $customerId, 'fieldName' => 'customerId']
                )
            );
        }
        if (!is_string($resetPasswordLinkToken) || empty($resetPasswordLinkToken)) {
            $params = ['fieldName' => 'resetPasswordLinkToken'];
            throw new InputException(__('%fieldName is a required field.', $params));
        }

        $customerSecureData = $customerRegistry->retrieveSecureData($customerId);
        $rpToken = $customerSecureData->getRpToken();
        $rpTokenCreatedAt = $customerSecureData->getRpTokenCreatedAt();

        if (!Security::compareStrings($rpToken, $resetPasswordLinkToken)) {
            throw new InputMismatchException(__('Reset password token mismatch.'));
        } elseif ($this->isResetPasswordLinkTokenExpired($rpToken, $rpTokenCreatedAt)) {
            throw new ExpiredException(__('Reset password token expired.'));
        }

        return true;
    }

    /**
     * Using ObjectManager here to simplify the rewrite, 
     * so we dont't need to define constructor class 
     */
    public function resetPassword($email, $resetToken, $newPassword)
    {
        $customerRepository = ObjectManager::getInstance()->get(\Magento\Customer\Api\CustomerRepositoryInterface::class);
        $customerRegistry = ObjectManager::getInstance()->get(\Magento\Customer\Model\CustomerRegistry::class);
        $customerSession = ObjectManager::getInstance()->get(\Magento\Customer\Model\Session::class);

        $customer = $customerRepository->get($email);
        //Validate Token and new password strength
        $this->validateResetPasswordToken($customer->getId(), $resetToken);
        $this->checkPasswordStrength($newPassword);
        //Update secure data
        $customerSecure = $customerRegistry->retrieveSecureData($customer->getId());
        $customerSecure->setRpToken(null);
        $customerSecure->setRpTokenCreatedAt(null);
        $customerSecure->setPasswordHash($this->createPasswordHash($newPassword));
        //$this->sessionManager->destroy();
        //$this->destroyCustomerSessions($customer->getId());
        $customerRepository->save($customer);

        // login customer
        $customerSession->setCustomerDataAsLoggedIn($customer);
        $customerSession->regenerateId();

        return true;
    }
}