When Identity Applications are configured for Kerberos authentication, the login process uses Kerberos contract by default. If you want to log in using the name-password contract instead of the default contact, use the following URL:
https://<ospserver:port>/osp/a/idm/auth/app?acAuthCardId=np-contract-$default-card$&target=https://<rbpm server:port>/idmdash/
The logout process relogins you to the system as Kerberos logged-in user. You need to logout to come out of the identity applications.