I believe that is one of the finer items the paper points out: OAuth2 is NOT an authentication protocol, its an authorization protocol.