As far as I can tell from the documentation you are required to created a Connected App (ex-Remote App) in order to use salesforce as the authentication authority.
However there are apps that don't require this e.g. Workbench, mobile apps. Why is it that you have to create a Connected App in some cases but not others?