I have been tasked with building a mobile app that requires users to login to a 3rd party service via OAuth2 to obtain some data about them. This mobile app also requires its own backend database storage via a webservice and access to this needs to be secured by user.
I understand the usage of OAuth2 in gaining permission to access 3rd party APIs, but I am less clear on using 3rd party authentication as the basis to secure my own webservice.
Many, many mobile apps use 3rd party social logins like Facebook as ways to offload the authentication process to a separate provider. I see the benefits of this, such as not needing to ever receive a users password. This post details the exact use case I was looking at
Further, the particular OAuth2 provider I am using does not return any unique user identifier I can use as a key for a user record in my database, only OAuth2 tokens and non unique user data.
This leads me to think that OAuth2 isn't really about offloading authentication to an oAuth provider at all: it is purely about gaining authorisation to access 3rd party APIs.
Are all of these 100s of mobile apps using OAuth2 social logins in place of their own authentication actually misusing OAuth2? Should my app have its own authentication and store the users credentials aside from requiring a social login to access their social information?