A client has two domain names, a .ca and a .com, that both point to the same D7 site (same codebase, same database, no custom
sites folder for either of them, so it's not a multisites situation; the Apache document root path is simply the same for both sites). Everything works fine except that nobody can log in to the .com version. There is no "unrecognized username or password" or other error generated, it just doesn't log them in. (Incorrect passwords do generate the error message.) Checking the log messages, I see that it opened and then immediately closed a session.
Changing cookie settings is not a viable approach here, because it's different top-level domains, not different subdomains.
One possible solution is to redirect one domain to the other instead of running them "in parallel" (I'm aware of the methods, pros and cons of this approach), but I'm interested in why this is and what else can be done about it.