I have a live site with customer details imported manually. At the time of import no customer passwords were provided so I set the email address as the password.
Now I need to be able to prompt users to change their password if it is still set to their email address.
I have an observer running on customer login but I can't seem to extract the existing password hash to compare. I have tried a couple of solutions:
1) Creating a new hash from the email address and comparing:
\Magento\Framework\Encryption\EncryptorInterface $encryptor
$this->encryptor->getHash("[email protected]");
However the hash this generates is nothing like the hash that is stored in the customer_entity table (same password though) - although the hash changes each time even when I set the same password.
2) "Fake" authenticating the user to see if password is still email:
try{
$cust = $this->customerAccountManagement->authenticate($customer->getEmail(), $customer->getEmail());
//die("1"); // authenticated correctly - change password!
}catch(\Exception $e){
//die("2"); // failed authentication - password different from email address - that's good.
}
Method 2 ..kind of.. works but for some reason when testing it logs the customer out.
I guess my real question is: How can I check if the logged in customers password is still set as their email?
Thanks