At least on Python 2.6, SSHAPasswordManager().checkPassword(hash, password) fails if hash is unicode, which it always is if stored in some databases. SSHAPasswordManager should encode the hash to utf-8 before trying to un-base64.

zope.password is conspicuously missing a DelegatingPasswordManager that parses hashes in the form of {scheme}hash and uses getUtility(IPasswordManager, SCHEME) to check a variety of schemes.

Thanks,

Daniel Holth