My requirement is something like login by Facebook, so the user does not provide password but gets logged in. I want to make a user logged in from within extension code by knowing his user id and/or username but not password.

How do I do that? I also tried to get user's encrypted password from database and put user name and that password in the login() method and then something went wrong, getting username and password mismatch error, although logged in!

I also found some codes from googling -

$options = array();
$options['action'] = 'core.login.site';
$response->username = "user_name_here";
$result = $app->triggerEvent('onUserLogin', array((array)$response, $options));

It seems to work, but I don't know if there is any chance of this becoming wrong later when doing this in both 2.5 and 3.0 versions.

  • We are working on a similar scenario, and when we use the code that dev-m put, our user is logged in, but seems not to correctly set up the session. Ad on the page reload, we are signed out. Are we missing something? Thank you Nicola
    – user8058
    Commented Mar 21, 2016 at 14:42

2 Answers 2


As far as I am aware, no piece of this is deprecated, so this code should definitely continue to function correctly in 2.5 and 3.0 installs. Even if something gets deprecated, you should be able to run this at least through version 4.0.

That being said, none of these pieces is likely to get removed. You are importing the user plugins and then triggering the onUserLogin event. This is the standard method to trigger plugins, so it should be consistent for a while.

The only other piece to remember is that you are undermining the security of requiring a user to login with their password. Do make sure that the piece that you are using to replace that is also secure.

Update per comment

The triggerEvent call runs through the different user plugins (found at plugins/user/ and calls the onUserLogin method if it exists. The key function is the one in the joomla plugin. I'm copying the entire function below:

public function onUserLogin($user, $options = array())
    $instance = $this->_getUser($user, $options);

    // If _getUser returned an error, then pass it back.
    if ($instance instanceof Exception)
        return false;

    // If the user is blocked, redirect with an error
    if ($instance->get('block') == 1)
        $this->app->enqueueMessage(JText::_('JERROR_NOLOGIN_BLOCKED'), 'warning');

        return false;

    // Authorise the user based on the group information
    if (!isset($options['group']))
        $options['group'] = 'USERS';

    // Check the user can login.
    $result = $instance->authorise($options['action']);

    if (!$result)
        $this->app->enqueueMessage(JText::_('JERROR_LOGIN_DENIED'), 'warning');

        return false;

    // Mark the user as logged in
    $instance->set('guest', 0);

    // Register the needed session variables
    $session = JFactory::getSession();
    $session->set('user', $instance);

    // Check to see the the session already exists.

    // Update the user related fields for the Joomla sessions table.
    $query = $this->db->getQuery(true)
        ->set($this->db->quoteName('guest') . ' = ' . $this->db->quote($instance->guest))
        ->set($this->db->quoteName('username') . ' = ' . $this->db->quote($instance->username))
        ->set($this->db->quoteName('userid') . ' = ' . (int) $instance->id)
        ->where($this->db->quoteName('session_id') . ' = ' . $this->db->quote($session->getId()));

    // Hit the user last visit field

    return true;

This plugin does not check the password at all (that is done by the authentication plugins). So this mostly just checks that the user is not blocked and can login before setting the user's data into the session.

That session storage is the key to showing the user as logged in. Naturally you could just use this code directly, but it would actually be way more complicated than just letting this plugin do the work of checking that the user isn't blocked, storing their information in the session, and marking the last visit time.

  • Thanks for reply, yes it's secure so that login request comes from correct user and i make him logged in by his user id/ username. But why and how this triggerEvent() method makes a user logged in even without pass!, is not it a leak as a user login should have password provided?.
    – dev-m
    Commented Aug 20, 2014 at 23:13
  • Finally, Is this the best way of making login without pass?. A thought: in joomla security perspective it's a leak i think as any bad third party plugins can take advantage of this leak and can login by someone's username!.
    – dev-m
    Commented Aug 21, 2014 at 13:41
  • 1
    This is an excellent example of why you need to be cautious of the extensions that get installed. It is not a security hole since it is not a venue for malicious code to get on your server. Code on your server makes everything work, so you should be able to change and adapt anything with more code. Commented Aug 21, 2014 at 16:20

If you change this, it'll work:

$options = array();
$options['action'] = 'core.login.site';
$response = array(); //Add this line
$response['language'] = ""; //Add this line
$response['username'] = "user_name_here"; //Change this line
$result = $app->triggerEvent('onUserLogin', array((array)$response, $options));

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.