diff --git a/Gemfile b/Gemfile
index ae58b90ef..b4dc085e0 100644
--- a/Gemfile
+++ b/Gemfile
@@ -40,6 +40,7 @@ gem "omniauth-google-oauth2", "~> 1.2.1"
 gem "omniauth-rails_csrf_protection", "~> 1.0.2"
 gem "omniauth-saml", "~> 2.2.4"
 gem "omniauth-twitter", "~> 1.4.0"
+gem "omniauth_openid_connect", "~> 0.8.0"
 gem "paranoia", "~> 3.0.1"
 gem "pg", "~> 1.5.9"
 gem "pg_search", "~> 2.3.7"
diff --git a/Gemfile.lock b/Gemfile.lock
index d4c6b3663..6be5fb5b4 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -85,6 +85,7 @@ GEM
     acts_as_votable (0.14.0)
     addressable (2.8.7)
       public_suffix (>= 2.0.2, < 7.0)
+    aes_key_wrap (1.1.0)
     afm (0.2.2)
     ahoy_matey (5.4.0)
       activesupport (>= 7.1)
@@ -103,6 +104,7 @@ GEM
     ancestry (4.3.3)
       activerecord (>= 5.2.6)
     ast (2.4.3)
+    attr_required (1.0.2)
     audited (5.8.0)
       activerecord (>= 5.2, < 8.2)
       activesupport (>= 5.2, < 8.2)
@@ -119,6 +121,7 @@ GEM
       parser (>= 2.4)
       smart_properties
     bigdecimal (3.2.2)
+    bindata (2.5.1)
     bindex (0.8.1)
     bing_translator (6.2.0)
       json
@@ -215,6 +218,8 @@ GEM
       htmlentities (~> 4.3.3)
       launchy (>= 2.1, < 4.0)
       mail (~> 2.7)
+    email_validator (2.2.4)
+      activemodel
     erb_lint (0.9.0)
       activesupport
       better_html (>= 2.0.1)
@@ -243,6 +248,8 @@ GEM
       faraday-net_http (>= 2.0, < 3.5)
       json
       logger
+    faraday-follow_redirects (0.3.0)
+      faraday (>= 1, < 3)
     faraday-net_http (3.4.0)
       net-http (>= 0.5.0)
     faraday-retry (2.3.1)
@@ -317,6 +324,13 @@ GEM
       rdoc (>= 4.0.0)
       reline (>= 0.4.2)
     json (2.12.2)
+    json-jwt (1.16.7)
+      activesupport (>= 4.2)
+      aes_key_wrap
+      base64
+      bindata
+      faraday (~> 2.0)
+      faraday-follow_redirects
     jwt (2.10.1)
       base64
     kaminari (1.2.2)
@@ -446,6 +460,22 @@ GEM
     omniauth-twitter (1.4.0)
       omniauth-oauth (~> 1.1)
       rack
+    omniauth_openid_connect (0.8.0)
+      omniauth (>= 1.9, < 3)
+      openid_connect (~> 2.2)
+    openid_connect (2.3.1)
+      activemodel
+      attr_required (>= 1.0.0)
+      email_validator
+      faraday (~> 2.0)
+      faraday-follow_redirects
+      json-jwt (>= 1.16)
+      mail
+      rack-oauth2 (~> 2.2)
+      swd (~> 2.0)
+      tzinfo
+      validate_url
+      webfinger (~> 2.0)
     orm_adapter (0.5.0)
     ostruct (0.6.1)
     parallel (1.27.0)
@@ -494,6 +524,13 @@ GEM
     rack (2.2.17)
     rack-accept (0.4.5)
       rack (>= 0.4)
+    rack-oauth2 (2.2.1)
+      activesupport
+      attr_required
+      faraday (~> 2.0)
+      faraday-follow_redirects
+      json-jwt (>= 1.11.0)
+      rack (>= 2.1.0)
     rack-protection (3.2.0)
       base64 (>= 0.1.0)
       rack (~> 2.2, >= 2.2.4)
@@ -687,6 +724,11 @@ GEM
       net-ssh (>= 2.8.0)
       ostruct
     stringio (3.1.1)
+    swd (2.0.3)
+      activesupport (>= 3)
+      attr_required (>= 0.0.5)
+      faraday (~> 2.0)
+      faraday-follow_redirects
     terminal-table (4.0.0)
       unicode-display_width (>= 1.1.1, < 4)
     terrapin (0.6.0)
@@ -713,6 +755,9 @@ GEM
       unicode-emoji (~> 4.0, >= 4.0.4)
     unicode-emoji (4.0.4)
     uri (1.0.3)
+    validate_url (1.0.15)
+      activemodel (>= 3.0.0)
+      public_suffix
     version_gem (1.1.8)
     view_component (3.23.2)
       activesupport (>= 5.2.0, < 8.1)
@@ -729,6 +774,10 @@ GEM
       activemodel (>= 6.0.0)
       bindex (>= 0.4.0)
       railties (>= 6.0.0)
+    webfinger (2.1.3)
+      activesupport
+      faraday (~> 2.0)
+      faraday-follow_redirects
     webrick (1.8.2)
     websocket (1.2.11)
     websocket-driver (0.7.7)
@@ -805,6 +854,7 @@ DEPENDENCIES
   omniauth-rails_csrf_protection (~> 1.0.2)
   omniauth-saml (~> 2.2.4)
   omniauth-twitter (~> 1.4.0)
+  omniauth_openid_connect (~> 0.8.0)
   paranoia (~> 3.0.1)
   pdf-reader (~> 2.14.1)
   pg (~> 1.5.9)