Accessing Yahoo Contacts through OAuth on App Engine (Python)

I have an existing webapp, running in Python on App Engine, in which users can login through open-id using a Yahoo account. Now, once they're signed in, I'd like them to be able to access their Yahoo contacts, through OAuth. I'm working though the Yahoo Python SDK and am just stuck.

I have the consumer key, consumer secret, app ID, and the callback URL is the same page, the use leaves from. Going to the Yahoo login pages seems to work fine and the user comes back to my site with an auth_token and auth_verifier. What do I do with those? Which strings do I need to store for future requests? Is there good sample code anywhere for these kinds of requests? Th开发者_开发知识库anks.

---

You should look for OpenID+Oauth Hybrid protocol.

OpenID+OAuth Hybrid protocol lets web developers combine an OpenID request with an OAuth authentication request.
This extension is useful for web developers who use both OpenID and OAuth, particularly in that it simplifies the process for users by requesting their approval once instead of twice.

The goal of OAuth is to acquire an access token from Google, which can then be used to exchange user-specific data with a Google service (such as calendar information or an address book). The regular OAuth process is a four-step sequence: (1) ask for a "request" token, (2) ask for the token to be authorized, which triggers user approval, (3) exchange the authorized request token for an "access" token, and (4) use the access token to interact with the user's Google service data. For a more detailed description, see OAuth for Web Applications.

With OpenID+OAuth, this sequence remains essentially the same. The difference is that getting an authorized OAuth request token (steps 1 and 2) is wrapped up in the OpenID authentication request. In this way, the user can approve login and service access at the same time.

Here a demo and source code (php) of Hybrid protocol using Google.

Here and here the Yahoo documentation to combine an OpenID authentication request with the approval of an OAuth request token.