Hi Antonio,
No, the asterisks (i.e. stars ****), they're just plain text to make log messages more visible in the crowd!
Passwords remain the very same until auth::authentication is completed. I confirmed that password hasn't been modified through all internal ad_procs by writing "ns_log Notices" (i.e. From auth::authenticate, auth::authenticate::Authenticate, ... , acs_sc::invoke to auth::authenticate)
While I was debugging, I had the same suspects of corruption that you had. Thus, I've set a very simple password (i.e. test and 098764321) and wrote ns_log notice along all the way through ad_procs.
Indeed, I'm im_generate_auto_login, but it's called only after auth::authentication proc has been completed. Meaning, authentication process is plain OpenACS.
Best wishes,
