[SalesForce] Problem with iframe for visualforce page in Lightning Component

I usually also set

pr.setRedirect(true);

to make the redirect happen clientside (instead of serverside) so that's worth a try. See for more info here.

What I would suggest is creating a public property on the controller to store the authURL

public String redirectURL { get; set; }

then doing the redirect in Javascript. For this, you'll need rendering the redirectURL in a div (you can't rerender javascript, it will become non-functional CDATA), and do the redirect using something like this

<apex:outputPanel id='redirectURLwrapper'>
    <div id='redirectURL'>{!redirectURL}</div>
</apex:outputPanel>

<script>
    function tryRedirect() {
        var redirect = document.getElementById("redirectURL")[0].innerHTML;
        if (redirect) { top.location.href = redirect; }
    }
</script>

<apex:actionFunction action="{! }" reRender="redirectURLwrapper" oncomplete="tryRedirect();" />

We use top.location.href to make the redirect happen at the top (browser-screen) level, so not inside the iFrame. I have not tested this code literally, but you should get the idea.

If you don't want to lose your existing page, you could also open the URL in a new window like so

<script>
    var windowObjectReference;
    function tryRedirect() {
        var redirect = document.getElementById("redirectURL")[0].innerHTML;
        if (redirect) { 
            windowObjectReference = window.open(redirect, 'newWindowName');                    
        }
        // the popup window should close itself in the return window. If that is not possible, then poll the windowObjectReference and after you detect a redirect, call windowObjectReference.close(); to close it
    }
</script>

Does that help?

Probably you'll find an answer there:

"For the same-origin policy every browser blocks any script trying to access a frame with a different origin... Protocol, hostname and port must be the same of your domain, if you want to access a frame". SecurityError: Blocked a frame with origin from accessing a cross-origin frame