I'm learning a lot and trying to wrap my head around everything in casdoor. I just want to verify my understanding. Typically Oauth deals with 3rd party authorization where after user authentication the "client" gets an access token with a limited scope and a "resource server" verifies that it has the access token is appropirate. The "access token" does not convey any information about the user. It's analogous to a key card at a hotel. The keycard lets you in the door, but it doesn't know who you are. Although casbin supports oauth+OIDC login, I don't understand how it supports the regular oauth model.
For example, in the casdoor UI, I see that we can create "Applications" which seem to be an oauth "client". It looks like I can facilitate Oauth+OIDC login, and then the client can apply casbin-style policies using it's model+policy framework. But if I wanted to implement an oauth resource server and have casdoor issue Access Tokens to a 3rd party client, I don't understand how I would do that.
So my thinking is that casdoor *only * supports the oauth+OIDC login, and then resource access is based on the user's identity, with the Casbin policy model. Is my understanding correct?
