We have implemented our own authentication module for IIS7 which would create an impersonation token using
lsalogonuser for authenticated user. We are using our own custom login pages to get the login credentials.These pages are placed under a virtual directory and the authentication is set to anonymous for that directory.
When a web application is accessed, login page is shown first. After entering the user credentials, user is authenticated and impersonation token
would be created and given access to the web application. Now if we try to logout using our custom logout page, we are getting 401 unauthorized for the logout page.
When we debug we see that 401 is returned by SPRequestModule. And we noticed that WSS_KeepSessionAuthenticated cookie is set by sharepoint for the
web application. If we remove this cookie, everything works fine.
How can we avoid this error and display these pages without any issues?
Do you know someone who can help? Share a link to this thread on twitter, or facebook.