title: Sharing session across rails apps on different subdomains
body: <p>I am trying to implement a single-sign-on solution for multiple rails (v3.2) apps hosted at different subdomains of example.com</p>
  
  <p>One app serves as an identity provider, uses devise for auth, and sits at users.example.com
  The other apps rely on the identity provider for authentication, use devise+omniauth, with domains of [app1.example.com, app2.example.com, and example.com].
  This blog entry inspired much of my implementation: <a href="http://blog.joshsoftware.com/2010/12/16/multiple-applications-with-devise-omniauth-and-single-sign-on/" rel="noreferrer">http://blog.joshsoftware.com/2010/12/16/multiple-applications-with-devise-omniauth-and-single-sign-on/</a></p>
  
  <p>I have it working fine, but the problem remains that the sessions are not shared so after I log in on the identity provider, I still have to make a call from each of the other apps to authenticate and I need this to be seemless to the user.</p>
  
  <p>I tried using the same secret token at secret_token.rb, same session key at session_store.rb and :domain => :all  (also tried '.example.com' and 'example.com' as values). Still no luck.</p>
  
  <p>Doing the above, I see in a session.inspect that after login on the identity provider the session variable "warden.user.user.key" is populated. When I immediately go to the app on app1.example.com, the session.inspect shows the same session_id and _csrf_token but the "warden.user.user.key" variable is now missing.</p>
  
  <p>I feel like I am missing something silly.. Any ideas what that may be?</p>