magento password change with soap - php

Question

I am connecting an other application to create and update customers in Magento 1.9 with SOAP. Because I want the passwords to stay exactly the same customers will be forced to change the password in the other application. After change I want the password to be changed in Magento Through the SOAP connection, but I can't get it working. After the request I am getting "bool(true)" but nothing seems to be changed.
Am I doing something wrong, or are there restrictions in Magento.
My code:
<?php
//ensure you are getting error output for debug
error_reporting(E_ALL | E_STRICT);
ini_set('display_errors',1);
$client = new SoapClient('http://www.mymagentosite.com/api/v2_soap/?wsdl');
// If some stuff requires api authentification,
// then get a session token
$session = $client->login('apiuser', 'apikey');
// CustomerID search
$params = array('complex_filter'=>
array(
array('key'=>'email','value'=>array('key' =>'eq','value' => $email)),
),
);
$result = $client->customerCustomerList($session, $params);
var_dump ($result);
$customerID = $result[0]->customer_id;
// echo $customerID;
// Update Customer
$result2 = $client->customerCustomerUpdate($session, $customerID, array('password' => 'newpassword'));
var_dump ($result2);

Answer 1

It's very strange.
The doc (and the wsdl) wants you to pass the password parameter.
I've tried to investigate in the code (Magento 1.7 series).
Before setting the values you have passed through the API call, in the corresponding update() function of the app/code/core/Mage/Customer/Model/Customer/Api.php file, there is this code:
foreach ($this->getAllowedAttributes($customer) as $attributeCode=>$attribute) {
if (isset($customerData[$attributeCode])) {
$customer->setData($attributeCode, $customerData[$attributeCode]);
}
}
So, I've tried to print the allowed attributes, and password is not present. What is present is password_hash, but this field is not present in the doc, and, more important, is not present in the wsdl.
Just to make a test, I've tried to pass the md5 value of the password I wanted to pass as the password argument, then, in the _prepareData function that is called in the update function, I've added this line of code:
$data['password_hash'] = $data['password'];
The result is that the password is successfully changed, and I can login with the new password.
Now, of course this is not the way to proceed.
First of all, I'm changing a core file.
Then, probably, it's possible to update the list of the allowed attributes adding the password attribute, but you have to remember to build the md5 version of the password, not the "clear text" one, and in any case rename it to password_hash somewhere.
Another solution is to customize (not in core/, again) the wsdl parameters related to the complex type customerCustomerEntityToCreate, adding password_hash.