Iframe yammer login in YammerProvider not working anymore in a new session

[pkmelee337]

Category

• Question
• Bug
• Enhancement

Authors

@VelinGeorgiev
@VesaJuvonen

Expected or Desired Behavior

We are using the code provided in the YammerProvider.ts for quite some time now to get access to the Yammer api. Our customers hated the popup, so this solution with the silent iframe login was awesome. When the user is logged in to SharePoint and Yammer Office 365 Identity Enforcement is Enabled already (which it off course is) the user is silently retrieving an authentication token through the iframe. When this fails the popup is shown. We moved this part behind a login button, because most browser are blocking popups not initiated by the user.

Observed Behavior

This was all working fine untill I believe a month ago. I did some research myself, and I do think this issue is somehow related to issue #775. When the authentication process is initiated on a new session, the iframe is also getting www.yammer.com/session.new page and not redirecting to the redirect page on our tenant. The iframe authentication therefore fails and the popup is showing. The popup is working fine, but I actually do not want to see this. I got a feeling something changed in the yammer authentication process and the fact I'm seeing the new Yammer webpart rolling out the past days on several tenants is confirming my thoughts.

My question to you guys is if you do see the same behavior and if you guys might have a solution to solve this. I did some research myself, but could not find the cause of this problem. I also contacted Yammer support and recreated the failing scenario on a tenant they gave me. Sadly as soon they went to the development team with this example the development team rejected it because the iframe login isn't a scenario which is in their documentation and therefore not supported.

Steps to Reproduce

Well, I think and hope you guys are seeing this issue also while running the react-yammer-api sample.

[pkmelee337]

In addition I also create an Yammer uservoice and this StackOverflow question.

[VelinGeorgiev]

Hey @pkmelee337, Unfortunately, we are not using Yammer in prod at the moment and therefore I missed sight of that.

I can add it in my long todo list and try to reproduce it and experiment with it, but I cannot give you any reasonable time frames since I am very busy now.

Would love if you can find something and share it here.

[pkmelee337]

Hi @VelinGeorgiev, Thanks for your reply. We were not able to fix this issue on the client side, so I created a server side api which is retrieving our data from yammer with App Authorization. We did need it to retrieve likes from Yammer, so it worked fine in our case. This isn't a good idea when it comes to sensitive information though...

[VelinGeorgiev]

Thanks for your response! Agree on the data, it was a 'quick win' for as you've said, retrieving non sensitive data by the time I was experimenting with SPFx. I will see if I can update the sample or simply remove it so it is not confusing for other.

[mjarmstrong]

Anyone find a client side way to resolve this?

[VelinGeorgiev]

There was a fix applied with that pull request #853. Do you experience the same issue after the fix?

[heinrich-ulbricht]

For me the IFrame-code does not work. Some intermediary page changed and the IFrame is never being redirected to my SharePoint tenant. Thus the code fails with the browser complaining about cross-domain access. Which is correct since the page in the frame got stuck on some page that requires user interaction.

[mjarmstrong]

@VelinGeorgiev, I'm still experiencing the same issue. To be clear, the issue isn't that the token isn't stored in subsequent sessions, it's that it doesn't get acquired (silently) on the first attempt. As @heinrich-ulbricht has pointed out, it appears something changed on the yammer side. When the authentication process is initiated on a new session, the iframe is getting directed to www.yammer.com/session.new and not redirecting to the redirect page on our tenant (with the token).

[hugoabernier]

@pkmelee337 did you ever resolve this issue?

I'll go ahead and close it as there has been no recent activity here, but if you're still experiencing this issue, feel free to open a new issue and maybe we can get a fresh set of eyes to look at this and get you the help you deserve.