OAuth 2.0 Protocol Request from the client

Question

RFC claims that (Figure 1):

(A) The client requests authorization from the resource owner. The authorization request can be made directly to the resource owner (as shown), or preferably indirectly via the authorization server as an intermediary.

Does this mean that, upon request from the resource owner, an authentication protocol is not used? Or what does it mean?

Answer 1

This means that the client can request the resource onwer credentials in both ways:

• Directly to the resource owner, asking for user and password to the resource owner and then sending them to the authorization server,
• Or preferably via the authorization server, for example when you use your google or facebook account to authenticate in a web site.