Dayo,
The OAuth2 code is actually originally from Joomla itself. You can find an almost identical file in /libraries/joomla/oauth2/client.php. We copied it so we could use the same file in Joomla 2.5 and 3.x as that file is only in 3.x. That function is near-identical between the 2 files and it definitely works.
As for who implemented that code in JFBConnect, it's me. The part your missing is that the first line in the authenticate function checks if a 'code' parameter is set. On the first call above, it definitely won't be as the round trip to VK or Yahoo hasn't happened yet. So, the line at the bottom like below should be called:
$this->application->redirect($this->createUrl());
That statement should always be called and the false should never be triggered because we force the sendhenders value to always be set.
So, step 3 calls authentication which redirects the user to VK or Yahoo or wherever to actually enter their credentials. Then, they should return to your site with a 'code' which is then posted back to that social network to get an actual authentication token. That's OAuth2 and yeah it's confusing, but it definitely works on many sites and in our automated tests suites we run against each social network before release.
Since your debugging code, here's what I'd recommend:
* In JFBConnect -> Configuration -> Facebook, set "Show 'Login Credentials' in popup" to 'No'. That will skip the popup flow for JFBConnect and use the same OAuth2 flow as the other networks. Knowing if that works helps narrow things down further.
* If you aren't already logged into those networks, when you click login, are you sent to enter your credentials properly? I believe so, and think you already answered this, but couldn't find it by skimming above.
* In the authenticate function, do a print_r($data) and exit after the first if statement. See if a code is ever printed as well as if that block is ever entered. If not, it means the code is never coming back from the network (or being stripped out by something on your site somewhere along the way).
* The 'code' should be in the URL. If you're using the browser's "Network" tab, you should see the looping requests and there should be a code= parameter in the URL. It should match the print statement above.
I hope that helps narrow some things down. We'll gladly keep helping diagnose things however we can.
Thanks,
Alex