I am trying to understand how would an application which uses OAuth2 (OIDC) server implement access control to its own resources.
In this case, the application is both 'Client' and 'Resource server' in terms of OAuth2.
So, user, from the browser, accesses the application and is being redirected to OIDC server where he gets authenticated, after which OIDC server sends access_token and id_token to the application (not to the user's browser, suppose the application is 'confidential' client in terms of OAuth2).
I suppose this access_token could be issued with access rights to the application (now acting as a 'Resource server'), which could be used to control the access to the application's resources to the user. But how could user send this access_token to the application (acting as a 'Resource server') since the user didn't get in possession of this token (it get's shared only with the application)?
Is it possible that this access_token be used to create some sort of "access" session between the user's browser and the application, similar to how id_token is used to build authentication session in form of a cookie? Or, is the authentication session used to obtain access_token from OIDC server every time a user accesses a different resource in the application, user being unaware of this communication since it is not asked for giving consent?
Or am I getting this whole thing completely wrong?
My case: suppose we have one web application which has backend and frontend, but frontend NOT being implemented as an SPA (in which case it would act as a 'Client'). The token is still shared between backend and AS (not going through the browser). How does my application control access to its resources? For example, the user is able to see the home page, but not an admin portal?
Please don't base your responses on my concrete use case, try to answer in general.