Get current user password before it is overwritten in user form? I know this is probably unlikely, but I am doing the diligence anyway.

Is there any way to get the current user password from Drupal before updating it with a new one on the user form (user editing account info)?

When it is updated, I would like to trigger an API call to a remote system and update the account password there, too (authentication happens on an external system). However, the API call requires the old password as well as the new one before it will update it.

Otherwise, I need to lock off any way of updating a password in Drupal from privileged users.
Yes you can. The password only gets hashed when the user entity is saved as part of PasswordItem::preSave().

So you can add a submit handler to the user form, fetch both the old password and the new password (as users are required to enter both usually*) and do what you want with it.

There are discussions about that being insecure, so it is possible that this will change in the future.


There are exceptions to this, for example after using a one time login link, users are allowed to change their password without providing the current one.