How are you doing the initial login request, in the iframe, or in the app that's loading the iframe? If Kibana is running on another hostname or port, the cookie isn't going to be valid.
Can you describe the entire flow of the application here? Is there a 401 somewhere? btw, which version are you using ? Logs, screenshots would help.
Thanks
Rashmi