If the domains don't match, most browsers will not pass the cookie values to the iframe nowadays, preventing login from working.
Unfortunately I never remember which web technology magic controls this. It might be the cookie SameSite flag, which can be customized via the config.php cookie keys.
