title: Django 1.11 authentication set_unusable_password vs setting password to None
body: <p>My team has overwritten the authenticate method for users years ago to authenticate against LDAP instead of djangos model backend.</p>
  
  <p>this method looks at LDAP for the user. If the user exists with correct username and password, it gets or creates the user (This means that the user doesn't have to exist as a model object in the Django database for someone to log in).</p>
  
  <p>The method leaves the newly created password as None. Then sets all the other information.</p>
  
  <p>I noticed that they, after validating the user, call the set_unusable_password on the user if they were valid. In a comment, they wrote that it overrides Django's built-in password handling... which obviously that makes sense. But I don't know why they needed to since we've already overwritten the authenticate method.</p>
  
  <p>I tested this out by removing the set_unusable_password so that the password is left as None and the validation worked. They were still able to log in with the password that's stored on LDAP. You still could not overwrite the password in the model to be different than that on LDAP and login with that.</p>
  
  <p>So basically the set_unusable_password call had no effect other than just creating a password... which wasn't used anyways.</p>
  
  <p>the only thing I can think of is that it may be a solution to an issue that was in older versions of Django (we're now in 1.11).</p>
  
  <p>After spending much time in the source code and in documentation, I couldn't figure out why we need it.</p>
  
  <p>Why would that be there? The people that wrote it have left by now so I have no explanation for why they did it. If I remove that, would there be any unwanted side effects?</p>