OAuth is a third party service. You should assume they test their core functionality so the remaining weak point is probably your implementation on which you should focus.
In cases like this I always recommend a heart to heart with the devs, they know what they struggled with and what might seem slightly hacky to them. Whatever you can get out of them( and getting it out might need some diplomatic skill) put it on the test charta.
Also put up a proxy and check what happens when the authentication service is down. Is it probably for all of e.g. Facebooks services to be down at the same time? Not really but I've seen implementations where really strange behavior surfaces once the service has gone away (could tell you a story about a series of bad decisions that resulted in an automatic login when the test env couldn't talk to the auth service) and you should know how your AUT behaves if it happens.
Also, if you work with automation be prepared for a world of pain. The login window will always open in its own sandbox and you have no control regarding what you get. Had a fun experience working against instagrams api once when they a/b tested their login. Nice 50/50 split of failing tests without changes in the AUT.