SSO style auth plugins that don't have a 'password' per se currently are able to use authenticate_user_login when $CFG->passwordpolicycheckonlogin is enabled, however, it gives a confusing notification to users telling them their password is not good enough but in reality they don't have a password at all (because they are using sso)

https://github.com/moodle/moodle/blob/c1463895d909245ee188fab39140f59b0eaeb847/lib/moodlelib.php#L3937

This is because they call this function with a null password (because there truly isn't one), which should skip this check and not output any notification, but instead outputs "Your current password no longer passes the set password policy. Please contact your Moodle administrator for assistance"

Some existing SSO auth plugins seem to get around this by supplying a garbage/random password, e.g.:

• LDAP uses the sesskey:  https://github.com/moodle/moodle/blob/c1463895d909245ee188fab39140f59b0eaeb847/auth/ldap/auth.php#L1792-L1801
• Shibboleth uses generate_password https://github.com/moodle/moodle/blob/c1463895d909245ee188fab39140f59b0eaeb847/auth/shibboleth/index.php#L44-L50

However I think its a hacky fix to generate a garbage password, instead auth plugins with null passwords should be supported properly.

To reproduce:

• Enable passwordpolicycheckonlogin
• Have an SSO auth plugin installed which does not have passwords i.e. can_change_password() and can_reset_password() both return false and passes a null password

• • E.g. auth_oidc https://github.com/microsoft/moodle-auth_oidc
    But an older version before https://github.com/microsoft/moodle-auth_oidc/commit/1a99913951eadfcdaaa554ab67a4e912846c1311 , since a change was made recently that passes in empty strings instead of null due to MDL-80064
• Login with auth_oidc, user will get a notification saying "Your current password no longer passes the set password policy. Please contact your Moodle administrator for assistance." - this should never be displayed, and confuses the user because they actually have no password to begin with.