@jerer

To test this yourself you can unpack the plugin (cd to the plugin directory and run php -r '$phar = new Phar("auth-oauth2.phar"); $phar->extractTo("./auth-oauth2");'), edit the auth-oauth2/oauth2.php file, and update the callback() method for class OAuth2EmailAuthBackend to the following:

    public function callback($resp, $ref=null) {
        $errors = [];
        $err = sprintf('%s_auth_bk', $this->account->getType());
        try {
            // MOD
            //if ($this->getState() == $resp['state']
            //        && ($token=$this->getAccessToken($resp['code']))
            //        && ($owner=$this->client->getResourceOwner($token))
            //        && ($attrs=$this->mapAttributes($owner->toArray()))) {
            if ($this->getState() == $resp['state']
                    && ($token=$this->getAccessToken($resp['code']))) {
                $this->resetState();
                $info =  [
                    'access_token' => $token->getToken(),
                    'refresh_token' => $token->getRefreshToken(),
                    'expires' => $token->getExpires(),
                    'resource_owner_id' => $token->getResourceOwnerId(),
                    //'resource_owner_email' => $attrs['email'],
                    'resource_owner_email' => $this->getEmailAddress(),
                ];
/*
                if (!isset($attrs['email']))
                    $errors[$err] = $this->error_msg(self::ERR_EMAIL_ATTR, $attrs);
                elseif (!$info['refresh_token'])
                    $errors[$err] = $this->error_msg(self::ERR_REFRESH_TOKEN);
                elseif (!$this->signIn($attrs)) {
                    // On strict mode email mismatch is an error, otherwise
                    // set email address being authorized as the resource
                    // owner - with the assumption that a global admin
                    // authorized the account.
                    if ($this->isStrict())
                        $errors[$err] = $this->error_msg(self::ERR_EMAIL_MISMATCH, $attrs);
                    else
                        $info['resource_owner_email'] = $this->getEmailAddress();
                }
*/
                if (!$info['refresh_token'])
                    $errors[$err] = $this->error_msg(self::ERR_REFRESH_TOKEN);
                // END

                // Update the credentials if no validation errors
                if (!$errors
                        && !$this->updateCredentials($info, $errors)
                        && !isset($errors[$err]))
                     $errors[$err] = $this->error_msg(self::ERR_UNKNOWN);
            }
        } catch (Exception $ex) {
            $errors[$err] =  $ex->getMessage();
        }

        // stash the results before redirecting
        $email = $this->getEmail();
        // TODO: check if email implements StashableTrait
        if ($errors)
            $email->stash('errors', $errors);
        else
            $email->stash('notice', sprintf('%s: %s',
                        $this->account->getType(),
                        __('OAuth2 Authorization Successful')
                        ));
        // redirect back to email page
        $this->onSignIn();
    }

Then login to the database, go to the _plugin table, modify your OAuth2 plugin record, set the install_path to plugins/auth-oauth2 (just remove the .phar), and set isphar to 0. Now the system will use the unpacked plugin with the custom changes.

With the above changes applied the system will skip the user endpoint altogether during token retrieval. You will then get a token successfully (as previously) but then when you try to authenticate using that token you are given it doesn't work (go figure).

Cheers.