A third-party PHP application stores data in the user\'s session (using a cookie for PHPSESSID). In this app, the $_SESSION variable contains all this data.
I finally solved the problem.
Symfony stores its session data in its own directory (app/cache/[environment]/sessions). So the solution is to set the default session path in config.yml:
framework:
session:
save_path: ~
This will set the default path back (for example /var/lib/php5 on Linux) and the legacy app session data is made available to the Symfony app.