As far as I am aware, no piece of this is deprecated, so this code should definitely continue to function correctly in 2.5 and 3.0 installs. Even if something gets deprecated, you should be able to run this at least through version 4.0.
That being said, none of these pieces is likely to get removed. You are importing the user plugins and then triggering the
onUserLogin event. This is the standard method to trigger plugins, so it should be consistent for a while.
The only other piece to remember is that you are undermining the security of requiring a user to login with their password. Do make sure that the piece that you are using to replace that is also secure.
Update per comment
triggerEvent call runs through the different user plugins (found at
plugins/user/ and calls the
onUserLogin method if it exists. The key function is the one in the
joomla plugin. I'm copying the entire function below:
public function onUserLogin($user, $options = array())
$instance = $this->_getUser($user, $options);
// If _getUser returned an error, then pass it back.
if ($instance instanceof Exception)
// If the user is blocked, redirect with an error
if ($instance->get('block') == 1)
// Authorise the user based on the group information
$options['group'] = 'USERS';
// Check the user can login.
$result = $instance->authorise($options['action']);
// Mark the user as logged in
// Register the needed session variables
$session = JFactory::getSession();
// Check to see the the session already exists.
// Update the user related fields for the Joomla sessions table.
$query = $this->db->getQuery(true)
->set($this->db->quoteName('guest') . ' = ' . $this->db->quote($instance->guest))
->set($this->db->quoteName('username') . ' = ' . $this->db->quote($instance->username))
->set($this->db->quoteName('userid') . ' = ' . (int) $instance->id)
->where($this->db->quoteName('session_id') . ' = ' . $this->db->quote($session->getId()));
// Hit the user last visit field
This plugin does not check the password at all (that is done by the authentication plugins). So this mostly just checks that the user is not blocked and can login before setting the user's data into the session.
That session storage is the key to showing the user as logged in. Naturally you could just use this code directly, but it would actually be way more complicated than just letting this plugin do the work of checking that the user isn't blocked, storing their information in the session, and marking the last visit time.