OAuth Overview

OAuth is an open network standard for authorization.
It defines a mechanism for issuing tokens, primarily encompassing four authorization modes: Authorization Code mode, Implicit mode, Resource Owner Password Credentials (ROPC) mode, and Client credentials mode. Spring Security OAuth2 implements all four of these authorization modes.

The Approach Behind OAuth

OAuth establishes an authorization layer between the "Client" and the "Service Provider". A client cannot directly log in to a service provider; instead, it logs into this authorization layer. This separation distinguishes the user from the client application.
The token used by the client to authenticate with the authorization layer is distinct from the user's password. During login, users can specify the scope and validity period of the authorization tokens issued by the layer.

Once a client successfully authenticates with the authorization layer, the service provider grants access to stored user data based on the defined scopes and expiration time contained within that token.