user_login_finalize() logins the user, but I remain anonymous I'm using user_login_finalize() in my code to login a user (right before the review page), and this works because I can see the log in drush watchdog-list. However, it only works behind the scenes: the browser session remains anonymous. The browser has a new anonymous session though.

It's almost like a new PHP thread is spawned for the user instead of using the old one (thus, Drupal logs the user and spawns a new thread, so the user is still anonymous even though Drupal has logged the old user). I don't know whether it does that, but that's what it looks like.

I know this doesn't help you per se, but I'd like at least to know how to debug that. I'm really lost there.

FWIW, here is the drush watchdog-show 66341 for the login:

 Wid        :  66341
 Type       :  user
 Message    :  Session opened for dsdsdsdsdsdsdsdsdsd@sdsdsds.com.
 Severity   :  notice
 Location   :  http://test.lxc:81/checkout/11
 Referer    :  http://test.lxc:81/checkout/11
 Hostname   :  192.168.120.1
 Date       :  08/oct 16:20
 Username   :  dsdsdsdsdsdsdsdsdsd@sdsdsds.com   


More information: I'm using the following code where I call user_login_finalize:

global $user;

$account = new stdClass();
$account-&gt;is_new = TRUE;

$edit = array(
  // More to come later, but this is the only constraint
  'name' =&gt; 'some random name',
);

$user = user_save($account, $edit);

// Checking $user here, it has the correct UID of a new user.

user_login_finalize();
You mean that the user remains anonymous in the browser session, right? (In Drush, you must pass -u uid on every invocation to specify the user, because Drush is stateless.)

Make sure that the Drupal session cookie is being set in the browser.  If, for example, you set the cookie in the secure context (https) and then redirect to http, the cookie will be inaccessible, and the user will remain anonymous.

Edit: user_login_finalize requires a $form_state parameter; see: http://api.drupal.org/api/drupal/modules%21user%21user.module/function/user_login_submit/7  It's hard to see which fields of the form state are relevant, since it is just passed to user_module_invoke.  However, if you compare what is in $form_state during a normal Drupal login, and supply the same information in your function, then it should work fine.