An organization has decided to contract with a cloud-based service provider to leverage their identity as a service offering. They will use Open Authentication (OAuth) 2.0 to authenticate external…

OAuth 2.0 is a delegated authorization framework where the end user (or client application acting on their behalf) presents an access token to access protected resources. The access token is issued by the authorization server after the user has authenticated through whatever mechanism the identity provider requires, and this token - not raw credentials - is what is presented to the resource server to prove authorization.

While a username and password may be used to authenticate to the identity provider (IdP) to obtain a token, OAuth 2.0 itself does not define credentials as the artifact presented to the resource/service - the access token is the mechanism OAuth 2.0 specifies for end-user authorization.

A username alone is insufficient for authentication under any standard protocol, and OAuth 2.0 specifically uses access tokens - not usernames - as the credential artifact presented to access protected services.

A password alone is not a valid authentication artifact in OAuth 2.0; the protocol is designed specifically to avoid passing raw credentials (like passwords) to resource servers by using access tokens instead.