Create a user and auto login
Actually, user_save() returns a user object, not TRUE. If it doesn't return FALSE, then the function was successful and you can use the returned object to log in that user.

For example, supposing that $user is the user object returned from user_save(), you can use the following code to replace the currently logged in user with that user (the code is for Drupal 7).

drupal_save_session(FALSE);
$original_user = $GLOBALS['user'];
$GLOBALS['user'] = $user;

// Do what you need.

$GLOBALS['user'] = $original_user;
drupal_save_session(TRUE);


The code can be used to do some actions impersonating another user, or when a user follows a link reported him in an email, which allows the user to log in. In the latter case, the last two lines should be removed from the code executed.

Without setting the value of $GLOBAL['user'], there isn't any way to let Drupal think a user is logged in.

user_authenticate() is not working because you are not passing the password for that account. In fact, Drupal doesn't save the password in any places; it saves the hash of the password, but that is not what user_authenticate() needs, as reported from its documentation page:


  Parameters
  
  $name User name to authenticate.
  
  $password A plain-text password, such as trimmed text from form values.
  
  Return value
  
  The user's uid on success, or FALSE on failure to authenticate.


The function passed its $password parameter to user_check_password(), which execute the following code:

  if (substr($account-&gt;pass, 0, 2) == 'U$') {
    // This may be an updated password from user_update_7000(). Such hashes
    // have 'U' added as the first character and need an extra md5().
    $stored_hash = substr($account-&gt;pass, 1);
    $password = md5($password);
  }
  else {
    $stored_hash = $account-&gt;pass;
  }

  $type = substr($stored_hash, 0, 3);
  switch ($type) {
    case '$S$':
      // A normal Drupal 7 password using sha512.
      $hash = _password_crypt('sha512', $password, $stored_hash);
      break;
    case '$H$':
      // phpBB3 uses "$H$" for the same thing as "$P$".
    case '$P$':
      // A phpass password generated using md5.  This is an
      // imported password or from an earlier Drupal version.
      $hash = _password_crypt('md5', $password, $stored_hash);
      break;
    default:
      return FALSE;
  }
  return ($hash &amp;&amp; $stored_hash == $hash);


As you see, $account-&gt;pass is used as stored hash of the password, while you are passing that value as password.