Password rehash never runs with CakeDC/Auth.Form (16.0.4) #1186

Follow-up to #1170. With 16.0.4 the warning from #1170 is gone, but the password is not rehashed anymore at all, without any log entry.

Cause

1. LoginComponent::handlePasswordRehash() returns early on

   if (!$authenticationProvider || !method_exists($authenticationProvider, 'getIdentifier')) {

   The provider of a form login is CakeDC\Auth\Authenticator\FormAuthenticator, which has no getIdentifier() method of its own. It forwards it to the base authenticator via __call(). method_exists() does not see methods behind __call(), so the check is always false and the rehash is skipped.

2. Even past that check, the default 'Auth.PasswordRehash.authenticators' => ['Form' => 'Authentication.Password'] does not match: the identifier configured as 'Authentication.Password' is registered as 'Password' in the identifier collection (ObjectRegistry strips the plugin prefix), as @Murl080 already noticed in warning: Error saving user id {id} password after rehashing: identifier Password not found. Check your Auth.PasswordRehash.identifiers configuration. #1170.

testLoginRehashWithAuthenticatorStructure does not catch either problem, because it mocks FormAuthenticator with addMethods(['getIdentifier']) and puts the identifier into the collection under 'Authentication.Password' by hand.

Steps to reproduce

• cakedc/users 16.0.4, cakedc/auth 10.1.4, cakephp/authentication 3.3.7, CakePHP 5.3, PHP 8.3
• default Auth.Authenticators.Form (CakeDC/Auth.Form with an Authentication.Password identifier) and the default Auth.PasswordRehash
• store a hash that needs a rehash for a user, e.g. password_hash('secret', PASSWORD_BCRYPT, ['cost' => 4])
• log in with that user

Expected: the password is saved with a new hash.
Actual: the hash is unchanged, nothing is logged.

Proposed fix

Use is_callable([$authenticationProvider, 'getIdentifier']) instead of method_exists(), and change the default config to 'Form' => 'Password'. PR: #1187

Side note: Docs/Documentation/Authentication.md still shows 'Auth.PasswordRehash' => ['identifiers' => ['PasswordLockout']], and since 16.0 Auth.Identifiers is no longer loaded, so that example cannot work anymore either.