Return via an abstract protected function?

Question

I'm looking at the auth class in Kohana 3 as well as a login script. When the login page calls the login function of the auth class, it is returned via a protected abstract function _login. Why would you do that out of curiosity? I can't seem to understand what would really be the difference since you'd be returning the same data either way. The one option that does swim around in my head is that by returning via a protected abstract you'd be making sure the data wasn't modified from the time it was put into the auth->login function and the time it leaves it. I'm trying to understand some of the nuances. Thanks.

 public function login($username, $password, $remember = FALSE)
 {
  if (empty($password))
   return FALSE;

  if (is_string($password))
  {
   // Get the salt from the stored password
   $salt = $this->find_salt($this->password($username));

   // Create a hashed password using the salt from the stored password
   $password = $this->hash_password($password, $salt);
  }

  return $this->_login($username, $password, $remember);
 }

and then....

 abstract protected function _login($username, $password, $remember);

Answer 1

This is a weak example of the Template Method design pattern. Every time someone wants to login, several modifications and checks must always be made against the variables. The password must not be empty. The password must be hashed.

Then an attempt to log the user in is made. Now, the reason that this function is abstract is that the login routine could be implemented in a number of different ways; for a number of different databases, with or without sessions, etc.

The reason that this function is protected is that you do not want anyone to call the concrete implementation of _login directly, without first having the prior checks and modifications (hashing password etc) run first.

So to summarise, it has been coded in this way to force all login requests to first have the length of password checked, and then the password hashed, before a concrete implementation of the real login function is called.