Can a service be Oauth2 provider and Oauth2 client at the same time?

Question

Let's say a new application X is an Oauth2 client and allows it's user to signup/login with other Oauth2 providers like Google. So a user U signs up using Google and regularly logins using Google to the application X.

But what happens if X is also an Oauth2 provider? That would be a bad experience for U in applications that allows login with X since the user would be redirected multiple times until the final provider (Google) is reached. And theoretically, the applications that allowed login with X could also become a provider in future. So the number of redirections are not strictly limited to 2.

So is it the case that an application can not be Oauth2 provider and Oauth2 client at the same time?

Answer 1

Yes, this is very common and one of the scenarios facilitated by identity protocols like OAuth2 and SAML.

Let's say you have an application and you decide to outsource identity management, e.g. to Azure AD B2C.

Your application will be an OAuth2 or OpenID Connect client to Azure AD B2C.

Now you want your users to be able to use an email/password combination or login using identity providers (IDPs) like Facebook or Google (the kind of experience login.realmadrid.com has, which uses AAD B2C).

So the user comes to your application and clicks "sign in". Your application will send the request to AAD B2C, which will ask the user to enter email/password and show buttons for Facebook and Google. If the user now clicks one of those buttons, then AAD B2C becomes a client and sends the user to either of those IDPs using OAuth2.

User enters credentials in Facebook or Google, they issue token to AAD B2C, which it will consume and then issue a token to your app.

Now your app doesn't really need to change as additional IDPs are added or existing ones removed, or if IDPs use different protocols because your app only needs to interact with AAD B2C.