I tested an installation of Plone 5.2 from scratch using Python 2.7. I noticed the login portlet is not working correctly. I get the sidebar as if I am logged in, but the main window shows the login dialog. (see screenshot)
Either I have big brain fart and miss the point or you are ignoring what I am writing.
I am not logged in to Zope! I am using an incognito browser window!
I have been using Plone for quite some time and never seen this behaviour before 5.2. It only occurs using the portlet. Login form works as expected.
Can someone confirm the login portlet on 5.2 is working?
I managed to replicate you problem.
Note: this was not with the universal installer, just with a buildout that I use for making a theme, so this could be a bug.
I tried both adding the login portlet to the root and the front page, both showed same (mis) behaviour.
I, too, can confirm a "login portlet" bug. Here, the portlet behaves slightly different (I am using a several months old "core-buildout" Plone installation which likely corresponds to some Plone 5.2 beta version). An initial analysis revealed that the "login portlet" uses login_form as form action. This action successfully verifies the login parameters (that's why we see the toolbar) but for some still unknown reason does not set the session cookie (that's why the next request is again unauthenticated) and does not perform the redirect but instead redisplays the login form.
I will continue the analysis and report back. But, you could already file a bug report.
The bug is understood: Plone is now using z3c.form for login_form. As a consequence, the expected button names have changed and the "login portlet" has not yet been adapted. Concretely: the "login portlet" causes the login button to get name "submit"; login_form, however, expects it to have the name buttons.login. Due to this discrepancy, login_form does not perform the login actions (set the cookie, redirect).
Products.CMFPlone can always be used as the primary target for problem reports (if one does not know a more appropriate target or one is unsure) - if necessary, the problem report is moved by a more knowledgable person.
Alterntively, you could try to find out from which package the "login portlet" comes and directly file a problem report for this package.