Search code examples
c#asp.net-mvcoauthasp.net-identity-2yahoo-oauth

"access_denied" when using Yahoo OAuth


I have an ASP.NET MVC 5 application which was migrated to ASP.NET Identity and I am in the progress of implementing OAuth authentification. Before the migration I was using Yahoo with OpenID which did work, but is no longer supported.
All common provider (Google, MS, Facebook, ...) are working fine, but I can't get Yahoo to work.
I am using the THIS provider.

When I do the authentication everything looks fine until it comes back to my page. There await AuthenticationManager.GetExternalLoginInfoAsync() returns null.

I then checked the complete "request stack" and saw the following "request-flow":

  1. Post back to http://mydomain.net/Account/ExternalLogin
  2. Response with header Location: https://api.login.yahoo.com/oauth/v2/request_auth?oauth_token=hwwvmgr
  3. Loging in via Yahoo
  4. Request to https://api.login.yahoo.com/oauth/v2/request_auth
  5. Response with header Location: http://mydomain.net/signin-yahoo?oauth_token=hwwvmgr&oauth_verifier=p2bppu
  6. Request to that URL
  7. Response with header Location: /Account/ExternalLoginCallback?error=access_denied

Does anybody have an idea why this could happen?

I executed this on a "real domain" which is verified at Yahoo.
The Configuration looks like the following:

var options = new YahooAuthenticationOptions();
options.ConsumerKey = settings.ConsumerKey;
options.ConsumerSecret = settings.ConsumerSecret;
app.UseYahooAuthentication(options);

Solution

  • Found the problem: Was a bug in the provider. If you check the History here:

    Version 1.5.1 - Fixed issue with Yahoo provider. Please see http://www.jerriepelser.com/blog/introducing-the-yahoo-linkedin-oauth-security-providers-for-owin for how to use the Yahoo provider correctly. Take note of the requirements for testing on localhost.

    I just updated the provider to version 1.6 (they just came out last week, so I had not updated yet) and it is working now.