In general, you shouldn't be relying strictly on OAuth2 for authentication as OAuth2 is an authorization mechanism, not an authentication mechanism. Though, if you're stuck with it, and you understand the security implications, you can use my OAuth2 Authentication module in Drupal.
The problem is that you have no guarantee that the resource requester is actually the resource owner. These two articles provide more detail on this, and explain real-world problems associated with it:
You should really be setting up OpenID Connect as it provides an authentication layer on top of OAuth2. Although SAML has been used traditionally, it it rather dated and isn't as versatile as OpenID Connect over OAuth2. As time goes on, we'll probably start seeing the Web move towards OpenID Connect, and away from SAML.
This is from the OpenID Connect FAQ:
The Security Assertion Markup Language (SAML) is an XML-based
federation technology used in some enterprise and academic use cases.
OpenID Connect can satisfy these same use cases but with a simpler,
JSON/REST based protocol. OpenID Connect was designed to also support
native apps and mobile applications, whereas SAML was designed only
for Web-based applications. SAML and OpenID Connect will likely
coexist for quite some time, with each being deployed in situations
where they make sense.