I have the following question about fusionauth. Is this service itself an identity provider or is it necessary to configure an external identity provider such as OpenId or SAML?
FusionAuth is a complete identity provider as well as a service provider. This means that you can store all of your users in FusionAuth and have them authenticate directly.
You can also use FusionAuth to log users in via other IdPs such as Google, Facebook, Twitter, GitHub, Active Directory, etc. This is called federated login and FusionAuth will handle reconciling user accounts.
Within FusionAuth, you can create an number of Applications, which are just resources a user can log into. Using FusionAuth as the identity provider via OAuth, OpenID Connect or SAMLv2, you get single sign-on for free. The UI for FusionAuth's login pages are also themeable, so you can make it look like your brand easily.
Finally, FusionAuth provides a complete authorization system as well. Each Application can define any number of roles. You then create a UserRegistration, which is a User, an Application and zero or more roles the User is granted for that Application.
Feel free to check out our documentation here: https://fusionauth.io/docs/
It provides a bunch of detail on all of these pieces.