In the general OAuth flow, when is the user authenticated, and which party is authenticated as part of the protocol?

User authentication is not part of the OAuth protocol: it is assumed to have happened beforehand at the authorization server. The only authentication inside the protocol is that of the application (client) when it requests the token (step ③/④).

This is a classic trick question because the flow looks like a login. But look at what the six steps actually specify:

• Steps ① and ② say the user grants authorisation. How the authorization server convinced itself that this really is the account owner (password, passkey, second factor, an existing session cookie) is left completely open. OAuth simply assumes the user was authenticated before consenting.
• In step ③ the client presents its own credentials (client ID and secret, or a key) along with the grant, and in step ④ the authorization server verifies them against the client's registration. That is the one authentication OAuth defines.

Consequence: an access token says the application is allowed to do something on behalf of some user. It carries no standardised statement about who the user is or how strongly they were authenticated. That missing piece is precisely what OpenID Connect adds with the ID token.

Go deeper:

• oauth.net: End User Authentication with OAuth 2.0 — why OAuth on its own is not an authentication protocol.