Log out also logs out the person I was before

[NicolasGoeddel]

Hi,

if I login as Zope admin from the Plone root, e.g. http://localhost:8080, then go to a site where I installed collective.impersonate I can impersonate a user without a problem, and when I log out again, I am still the admin user. But when I login as an admin from within the site itself (http://localhost:8080/Plone), then impersonate a user and log out a again, I am logged out completely. I have to login as admin again to gain access.

Step by step:

1. Install a fresh Plone.
2. Login as admin and create a new site: NewSite
3. Logout completely: http://localhost:8080/@@plone-root-logout
4. Login again as admin at http://localhost:8080/NewSite
5. Create a new user
6. Impersonate that user
7. Click on Log out.

Now you are not admin anymore but logged out completely.

[jensens]

I think this is because at the Zope root you are logged in with Basic Auth. Impersonate then logs you in with AuthTKT, which first kicks in (PAS plugin order). After impersonated logout, the Basic Auth is still there, so youre logged in as admin still. In fact you never log out as admin, its just unused while impersonanted user is loged in. I logged in in /plone, the admin is loged in with AuthTKT, impersonate overrides this login (logs admin out) and does not remember who it was before.

I think this is a feature-by-accident.