Hi. I'm really impressed with the features of dotnetnuke, but I have a problem with authentication:

I run 3.2.2, with single sign on enabled, users are automatically synchronized when they are logged into the domain. However, it seems like dotnetnuke writes a persistent cookie with auth.-info. If I later use the same browser, this time authenticated against AD as another user, I get logged in as the SAME user as I was before...

Also, if a user chooses "log out", he is not able to get authenticated again until deleting the dotnetnuke-cookie...

Is this a bug, or is it just me missing som configuration of this auth-cookie ?

Not sure about the cookie stuff at all.  When using autologin shouldn't you be pointing users to /portal/admin/security/windowssignin.aspx?

That is what works for me.  I then put a links module with a link to the same url, just in case someone logs out unintentionally.

--Mark

I have links pointing to that file in several places.  Using AD GPO, I push out favorites to our website, which is that file, and force the students to use that URL as their start page in IE.  Then, for those people that don't have it forced as their start page, or use the favorites to access the website, I created a custom login page that contains a link to that file for IntraNet users and the normal login box for "public" users.

Not a perfect way of doing it, but it works for now.  Note that this solution is only for "psuedo-mixed-mode" systems.  If you want an Intranet-Only system, uncomment that line in the web.config and everyone accessing your site will automatically be logged in without having to specifically access that file at all.

Take a look: http://www.mapsnet.org/Home/Login/tabid/52/Default.aspx