What to do after getting oauth2 token?

Question

I'm trying to implement a "Sign in with ..." authentication system.

I've read several posts and articles on oauth2. Everyone that I've read stops the discussion or tutorial at getting the access token and possibly logging in the user for that session.

I understand that and can implement that part. Here's what I don't get:

1. When the user leaves the site and doesn't come back for a week, but they're still logged into the client, how do I log them back into my app? I know you save the access token to the DB, but how do you use that to log them back in?

2. If they're logged out of the client, how do you redirect them to the sign in page of the client. It seems that every time I try to log back in I'm asked to allow or deny the app again. I know that isn't standard, so how do I fix that? What do I send the client so that it knows that the user has already authorized the app?

I don't need a code sample unless someone knows of an article, what I would really like is just a high level overview of what to do with the access token after I have received and saved it.

Thanks!

EDIT:

I understand that OAuth2 isn't an authorization system in itself, but everyone and their dog has a "Login with..." option. And in order to do this it's necessary to use OAuth2 (or some form of API identifier). That's what I'm trying to do.

Does the following sound like the correct flow:

1. Get temporary code from auth server
2. Trade that for access token
3. Get user data from auth server and do whatever you want with it (probably save to a DB).
4. Log the user in, saving the refresh token as well.
5. Set an identifier in a cookie for the user (the access token)
6. When user comes back, identify them via the cookie token.
7. Try to make a call to the api and see if the access token is still valid.
8. If access token is still valid, great!
9. If access token isn't valid, then get a new one via the refresh token.

Is that the basic gist of using OAuth2 to help authenticate a user?

Answer 1

First of all, OAuth2 is not an authentication protocol. The issued access token does not sign you in, but allows you to call a web service (API).

OpenID Connect is an authentication protocol built on top of OAuth2. It allows you to get back an id_token from the authorization server that identifies the user. If you safe the token (or the info in it) in for example a cookie, you can establish a authenticated session for the user.

You also do not store access tokens in a database. Access tokens are short-lived and storing them on the server side serves no purpose.

You do store the refresh token in a database. When the client (app requesting the token) is confidential (can keep a secret), a refresh token may be issued. The client can use this refresh token to request a new access token for the API when the old token expires. This is what will surely happen when the user did not visit the app for a week.