public function login($userName, $password, $setSessionCookie = false)
    {
        $isLoginAttemptToAdminBackend = $this->isAdmin();

        $cookie = Registry::getUtilsServer()->getOxCookie();
        if ($cookie === null && $isLoginAttemptToAdminBackend) {
            throw oxNew(CookieException::class, 'ERROR_MESSAGE_COOKIE_NOCOOKIE');
        }

        $config = Registry::getConfig();
        $shopId = $config->getShopId();

        /** New authentication mechanism */
        $passwordHashFromDatabase = $this->getPasswordHashFromDatabase($userName, $shopId, $isLoginAttemptToAdminBackend);
        $passwordServiceBridge = $this->getContainer()->get(PasswordServiceBridgeInterface::class);
        if ($password && !$this->isLoaded()) {
            $userIsAuthenticated = $passwordServiceBridge->verifyPassword($password, $passwordHashFromDatabase);
            if ($userIsAuthenticated) {
                $this->loadAuthenticatedUser($userName, $shopId);
            }
        }

        /** Old authentication + authorization */
        if ($password && !$this->isLoaded()) {
            $this->_dbLogin($userName, $password, $shopId);
        }

        /** If needed, store a rehashed password with the authenticated user */
        if ($password && $this->isLoaded()) {
            $algorithm = Registry::getConfig()->getConfigParam('passwordHashingAlgorithm', 'PASSWORD_BCRYPT');
            $passwordNeedsRehash = $this->isOutdatedPasswordHashAlgorithmUsed ||
                                   $passwordServiceBridge->passwordNeedsRehash($passwordHashFromDatabase, $algorithm);
            if ($passwordNeedsRehash) {
                $generatedPasswordHash = $this->hashPassword($password);
                $this->oxuser__oxpassword = new Field($generatedPasswordHash, Field::T_RAW);
                /** The use of a salt is deprecated and an empty salt will be stored */
                $this->oxuser__oxpasssalt = new Field('');
                $this->save();
            }
        }

        /** Event for alternative authentication and authorization mechanisms, or whatsoever */
        $this->onLogin($userName, $password);

        /**
         * If the user has not been loaded until this point, authentication & authorization is considered as failed.
         */
        if (!$this->isLoaded()) {
            throw oxNew(UserException::class, 'ERROR_MESSAGE_USER_NOVALIDLOGIN');
        }

        //resetting active user
        $this->setUser(null);

        if ($isLoginAttemptToAdminBackend) {
            Registry::getSession()->setVariable('auth', $this->oxuser__oxid->value);
        } else {
            Registry::getSession()->setVariable('usr', $this->oxuser__oxid->value);
        }

        // cookie must be set ?
        if ($setSessionCookie && $config->getConfigParam('blShowRememberMe')) {
            Registry::getUtilsServer()->setUserCookie(
                $this->oxuser__oxusername->value,
                $this->oxuser__oxpassword->value,
                $config->getShopId(),
                31536000,
                static::USER_COOKIE_SALT
            );
        }

        return true;
    }