diff --git a/.env.example b/.env.example
index b1ff91de7..0a3a33ea6 100644
--- a/.env.example
+++ b/.env.example
@@ -165,6 +165,45 @@ GITHUB_CLIENT_ID=
 GITHUB_CLIENT_SECRET=
 GITHUB_AUTH_CALLBACK="${APP_URL}/auth/github/callback"
 
+# Generic OpenID Connect (user login/signup) - works with any spec-compliant
+# provider (Authentik, Keycloak, Pocket ID, Zitadel, ...).
+# OIDC_DISCOVERY_URL takes the issuer URL or the full .well-known URL.
+# OIDC_DISPLAY_NAME is what the login button says: "Log in with <name>".
+# Register the callback below as the redirect URI in your provider.
+# Switch off email + password sign-in once an identity provider is in place.
+# Ignored while no other provider is enabled, so this cannot lock you out.
+PASSWORD_LOGIN_ENABLED=true
+
+OIDC_AUTH_ENABLED=false
+OIDC_CLIENT_ID=
+OIDC_CLIENT_SECRET=
+OIDC_DISCOVERY_URL=
+OIDC_AUTH_CALLBACK="${APP_URL}/auth/oidc/callback"
+OIDC_SCOPES="openid profile email"
+OIDC_DISPLAY_NAME="SSO"
+# Also end the session at the provider when logging out of TryPost.
+OIDC_LOGOUT_ENABLED=true
+# Optional: where the provider returns the browser after logout. Must match a
+# post-logout redirect URI registered with the provider exactly; leave empty to
+# simply stay on the provider's page.
+OIDC_POST_LOGOUT_REDIRECT_URI=
+# Restrict sign-in to provider groups (comma separated). Empty = no extra gate.
+OIDC_GROUPS_CLAIM=groups
+OIDC_ALLOWED_GROUPS=
+# Place new OIDC users on the shared account instead of requiring an invite
+# each. OIDC_AUTO_JOIN_ACCOUNT_ID defaults to the oldest account.
+OIDC_AUTO_JOIN_ENABLED=false
+OIDC_AUTO_JOIN_ROLE=member
+# Groups whose members administer the workspace. With this set, the role of
+# every OIDC user follows the provider on each sign-in - no standing local
+# admin account needed.
+OIDC_ADMIN_GROUPS=
+# Clear the account owner so that every right is derived from provider groups.
+# Owner-only actions (deleting a workspace, billing) then become unavailable to
+# everyone; everything operational runs on the admin role.
+OIDC_RELEASE_OWNERSHIP=false
+OIDC_AUTO_JOIN_ACCOUNT_ID=
+
 # Pinterest (https://developers.pinterest.com)
 PINTEREST_CLIENT_ID=
 PINTEREST_CLIENT_SECRET=
diff --git a/app/Actions/Auth/JoinOidcUserToAccount.php b/app/Actions/Auth/JoinOidcUserToAccount.php
new file mode 100644
index 000000000..a3aa51d48
--- /dev/null
+++ b/app/Actions/Auth/JoinOidcUserToAccount.php
@@ -0,0 +1,92 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Actions\Auth;
+
+use App\Actions\Account\CancelAccountSubscription;
+use App\Enums\UserWorkspace\Role as WorkspaceRole;
+use App\Models\Account;
+use App\Models\User;
+use Illuminate\Support\Facades\DB;
+
+/**
+ * Puts a user who just signed in through OIDC onto the instance's shared
+ * account, so that group membership at the identity provider is all the
+ * onboarding a self-hosted team needs - no second invite per person.
+ *
+ * Mirrors AcceptInvite: move the account, attach the workspaces, then drop the
+ * empty personal account that signup leaves behind.
+ */
+class JoinOidcUserToAccount
+{
+    public static function execute(User $user, WorkspaceRole $role): bool
+    {
+        $account = self::targetAccount();
+
+        if (! $account || $user->account_id === $account->id) {
+            return false;
+        }
+
+        $workspaces = $account->workspaces()->orderBy('created_at')->get();
+
+        // Nothing to join yet - the team has not created a workspace.
+        if ($workspaces->isEmpty()) {
+            return false;
+        }
+
+        $previousAccountId = $user->account_id;
+
+        DB::transaction(function () use ($user, $account, $workspaces, $role): void {
+            $user->update(['account_id' => $account->id]);
+            $user->refresh();
+
+            foreach ($workspaces as $workspace) {
+                $alreadyMember = $workspace->members()
+                    ->where('users.id', $user->id)
+                    ->exists();
+
+                // Never overwrite an existing pivot role (avoids demoting admins).
+                if (! $alreadyMember) {
+                    $workspace->members()->attach($user->id, ['role' => $role->value]);
+                }
+            }
+
+            $user->update(['current_workspace_id' => $workspaces->first()->id]);
+            $user->refresh();
+        });
+
+        // Drop the personal account shell after commit, the same way invite
+        // acceptance does, so Stripe cancellation is not held inside the
+        // transaction.
+        if ($previousAccountId) {
+            $shell = Account::query()
+                ->whereKey($previousAccountId)
+                ->where('owner_id', $user->id)
+                ->whereDoesntHave('workspaces')
+                ->first();
+
+            if ($shell && CancelAccountSubscription::execute($shell)) {
+                $shell->delete();
+            }
+        }
+
+        return true;
+    }
+
+    /**
+     * The account new OIDC users are placed on. Configurable for instances that
+     * host more than one team; otherwise the oldest account, which on a
+     * self-hosted install is the one the first admin created.
+     */
+    private static function targetAccount(): ?Account
+    {
+        $configured = config('trypost.oidc_auto_join_account_id');
+
+        if (filled($configured)) {
+            return Account::find($configured);
+        }
+
+        return Account::query()->orderBy('created_at')->first();
+    }
+}
diff --git a/app/Actions/Auth/ReleaseAccountOwnership.php b/app/Actions/Auth/ReleaseAccountOwnership.php
new file mode 100644
index 000000000..beacb2b7a
--- /dev/null
+++ b/app/Actions/Auth/ReleaseAccountOwnership.php
@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Actions\Auth;
+
+use App\Models\User;
+
+/**
+ * Hands an account over to group management by clearing its owner.
+ *
+ * Ownership outranks the workspace role, so as long as one person holds it
+ * their rights cannot follow their provider groups - they are permanently
+ * outside the very system that is supposed to govern access. On an instance
+ * where the provider decides who may do what, that is the one exception too
+ * many.
+ *
+ * `accounts.owner_id` is nullable and every check against it is a comparison,
+ * so an account without an owner is a supported state: the owner-only actions
+ * (deleting a workspace, billing) become unavailable to everyone, and
+ * everything operational - connecting accounts, managing the team, inviting -
+ * runs on the admin role, which does follow the groups.
+ */
+class ReleaseAccountOwnership
+{
+    public static function execute(User $user): bool
+    {
+        if (! config('trypost.oidc_release_ownership')) {
+            return false;
+        }
+
+        $account = $user->account;
+
+        if (! $account || blank($account->owner_id)) {
+            return false;
+        }
+
+        $account->update(['owner_id' => null]);
+
+        return true;
+    }
+}
diff --git a/app/Actions/Auth/SyncOidcWorkspaceRole.php b/app/Actions/Auth/SyncOidcWorkspaceRole.php
new file mode 100644
index 000000000..4e8ab42b9
--- /dev/null
+++ b/app/Actions/Auth/SyncOidcWorkspaceRole.php
@@ -0,0 +1,65 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Actions\Auth;
+
+use App\Enums\UserWorkspace\Role as WorkspaceRole;
+use App\Models\User;
+
+/**
+ * Derives a user's workspace role from the groups their identity provider
+ * reports, on every sign-in.
+ *
+ * This is what lets an instance run without a standing local admin account:
+ * add somebody to the admin group at the provider and they can administer the
+ * workspace; take them out and they cannot, without anyone touching the
+ * application. Offboarding then happens in exactly one place.
+ */
+class SyncOidcWorkspaceRole
+{
+    /**
+     * @param  array<int, string>  $groups  Group names as reported by the provider.
+     */
+    public static function execute(User $user, array $groups): void
+    {
+        $adminGroups = self::configuredAdminGroups();
+
+        // Without an admin group configured, roles stay under whoever manages
+        // them in the application - invites, or an admin changing them by hand.
+        if ($adminGroups === []) {
+            return;
+        }
+
+        // Ownership is resolved through account.owner_id and outranks the
+        // workspace role, so demoting an owner here would show "member" in the
+        // interface while they keep every permission. Leave owners alone rather
+        // than display a right they still have as one they lost.
+        if ($user->account?->owner_id === $user->id) {
+            return;
+        }
+
+        $target = array_intersect($groups, $adminGroups) !== []
+            ? WorkspaceRole::Admin
+            : WorkspaceRole::tryFrom((string) config('trypost.oidc_auto_join_role')) ?? WorkspaceRole::Member;
+
+        foreach ($user->workspaces as $workspace) {
+            if ($workspace->pivot->role === $target->value) {
+                continue;
+            }
+
+            $workspace->members()->updateExistingPivot($user->id, ['role' => $target->value]);
+        }
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    private static function configuredAdminGroups(): array
+    {
+        return array_values(array_filter(array_map(
+            'trim',
+            explode(',', (string) config('trypost.oidc_admin_groups'))
+        )));
+    }
+}
diff --git a/app/Actions/User/CreateUser.php b/app/Actions/User/CreateUser.php
index 2cae6e8b6..fd8cc3da5 100644
--- a/app/Actions/User/CreateUser.php
+++ b/app/Actions/User/CreateUser.php
@@ -18,7 +18,7 @@
 class CreateUser
 {
     /**
-     * @param  array{name: string, email: string, password?: string, google_id?: string, github_id?: string, email_verified_at?: \DateTimeInterface|null, is_invite?: bool, registration_ip?: string|null, locale?: string}  $data
+     * @param  array{name: string, email: string, password?: string, google_id?: string, github_id?: string, oidc_id?: string, email_verified_at?: \DateTimeInterface|null, is_invite?: bool, registration_ip?: string|null, locale?: string}  $data
      * @param  array<string, string>  $attributionParameters  UTM parameters and ad click IDs (gclid, fbclid, etc.) captured before signup
      */
     public static function execute(array $data, array $attributionParameters = []): User
@@ -45,6 +45,7 @@ public static function execute(array $data, array $attributionParameters = []):
                 'password' => data_get($data, 'password'),
                 'google_id' => data_get($data, 'google_id'),
                 'github_id' => data_get($data, 'github_id'),
+                'oidc_id' => data_get($data, 'oidc_id'),
                 'email_verified_at' => data_get($data, 'email_verified_at', $isInviteRegistration ? now() : null),
                 'account_id' => $account->id,
                 'registration_ip' => data_get($data, 'registration_ip'),
@@ -67,6 +68,7 @@ public static function execute(array $data, array $attributionParameters = []):
                 $authProvider = match (true) {
                     (bool) $user->google_id => 'google',
                     (bool) $user->github_id => 'github',
+                    (bool) $user->oidc_id => 'oidc',
                     default => 'email',
                 };
 
diff --git a/app/Enums/Auth/SocialAuthProvider.php b/app/Enums/Auth/SocialAuthProvider.php
index ebb2179f5..1d8d6f7e4 100644
--- a/app/Enums/Auth/SocialAuthProvider.php
+++ b/app/Enums/Auth/SocialAuthProvider.php
@@ -8,12 +8,16 @@ enum SocialAuthProvider: string
 {
     case Google = 'google';
     case GitHub = 'github';
+    case Oidc = 'oidc';
 
     public function label(): string
     {
         return match ($this) {
             self::Google => 'Google',
             self::GitHub => 'GitHub',
+            // Self-hosted providers are named by the operator, so the button
+            // can read "Login with <company> SSO" instead of "OIDC".
+            self::Oidc => (string) config('trypost.oidc_display_name'),
         };
     }
 
diff --git a/app/Http/Controllers/App/Settings/AuthenticationController.php b/app/Http/Controllers/App/Settings/AuthenticationController.php
index 24fd1bfa0..fb263d211 100644
--- a/app/Http/Controllers/App/Settings/AuthenticationController.php
+++ b/app/Http/Controllers/App/Settings/AuthenticationController.php
@@ -72,6 +72,7 @@ public function connectProvider(string $provider): RedirectResponse
         return match ($socialProvider) {
             SocialAuthProvider::Google => Socialite::driver('google-auth')->redirect(),
             SocialAuthProvider::GitHub => Socialite::driver('github')->scopes(['read:user', 'user:email'])->redirect(),
+            SocialAuthProvider::Oidc => Socialite::driver('oidc')->redirect(),
         };
     }
 
diff --git a/app/Http/Controllers/Auth/AuthenticatedSessionController.php b/app/Http/Controllers/Auth/AuthenticatedSessionController.php
index b586dd687..290bbfe8e 100644
--- a/app/Http/Controllers/Auth/AuthenticatedSessionController.php
+++ b/app/Http/Controllers/Auth/AuthenticatedSessionController.php
@@ -4,16 +4,20 @@
 
 namespace App\Http\Controllers\Auth;
 
+use App\Enums\Auth\SocialAuthProvider;
 use App\Http\Controllers\Controller;
 use App\Http\Requests\App\Auth\LoginRequest;
 use App\Jobs\PostHog\SyncUser;
 use App\Models\Invite;
 use App\Services\PostHogService;
+use App\Socialite\OidcProvider;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
 use Inertia\Inertia;
 use Inertia\Response;
+use Laravel\Socialite\Facades\Socialite;
+use Symfony\Component\HttpFoundation\Response as HttpResponse;
 
 class AuthenticatedSessionController extends Controller
 {
@@ -57,14 +61,71 @@ public function store(LoginRequest $request): RedirectResponse
     /**
      * Destroy an authenticated session.
      */
-    public function destroy(Request $request): RedirectResponse
+    public function destroy(Request $request): RedirectResponse|HttpResponse
     {
+        // Read before the session goes away: RP-initiated logout needs the ID
+        // token of this session as a hint for the provider.
+        $endSessionUrl = $this->oidcEndSessionUrl($request);
+
         Auth::guard('web')->logout();
 
         $request->session()->invalidate();
 
         $request->session()->regenerateToken();
 
-        return redirect('/');
+        // Logging out is posted by Inertia, so an ordinary redirect would be
+        // followed by fetch() and die on the provider's CORS preflight - the
+        // browser never navigates and the provider session survives.
+        // Inertia::location makes the client do a full page visit, and still
+        // answers a non-Inertia request with a plain redirect.
+        return $endSessionUrl ? Inertia::location($endSessionUrl) : redirect('/');
+    }
+
+    /**
+     * Where to send the browser so the identity provider ends its own session
+     * as well. Without this, "log out" only clears the local session and the
+     * next click signs the same user straight back in - which is the opposite
+     * of what someone on a shared machine expects.
+     *
+     * Null when the user did not sign in through OIDC, when the provider
+     * publishes no logout endpoint, or when the operator turned it off.
+     */
+    private function oidcEndSessionUrl(Request $request): ?string
+    {
+        if (! SocialAuthProvider::Oidc->isEnabled() || ! config('trypost.oidc_logout_enabled')) {
+            return null;
+        }
+
+        $idToken = $request->session()->get(OidcController::ID_TOKEN_SESSION_KEY);
+
+        if (! is_string($idToken) || blank($idToken)) {
+            return null;
+        }
+
+        try {
+            $driver = Socialite::driver('oidc');
+        } catch (\Throwable) {
+            return null;
+        }
+
+        if (! $driver instanceof OidcProvider || blank($endpoint = $driver->endSessionEndpoint())) {
+            return null;
+        }
+
+        $parameters = [
+            'id_token_hint' => $idToken,
+            'client_id' => config('services.oidc.client_id'),
+        ];
+
+        // Only sent when the operator configured one. A post-logout redirect
+        // has to match a URI registered with the provider character for
+        // character; sending an unregistered one makes providers reject the
+        // whole request, and the user is left signed in while believing they
+        // are not. Without it they simply stay on the provider's page.
+        if (filled($returnTo = config('trypost.oidc_post_logout_redirect_uri'))) {
+            $parameters['post_logout_redirect_uri'] = $returnTo;
+        }
+
+        return $endpoint.(str_contains($endpoint, '?') ? '&' : '?').http_build_query($parameters);
     }
 }
diff --git a/app/Http/Controllers/Auth/OidcController.php b/app/Http/Controllers/Auth/OidcController.php
new file mode 100644
index 000000000..32ed26421
--- /dev/null
+++ b/app/Http/Controllers/Auth/OidcController.php
@@ -0,0 +1,274 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Auth;
+
+use App\Actions\Auth\JoinOidcUserToAccount;
+use App\Actions\Auth\ReleaseAccountOwnership;
+use App\Actions\Auth\SyncOidcWorkspaceRole;
+use App\Actions\User\CreateUser;
+use App\Actions\Workspace\CreateWorkspace;
+use App\Enums\Auth\SocialAuthProvider;
+use App\Enums\UserWorkspace\Role as WorkspaceRole;
+use App\Http\Controllers\Auth\Concerns\PreservesAttributionParameters;
+use App\Http\Controllers\Auth\Concerns\PreservesInvite;
+use App\Http\Controllers\Controller;
+use App\Models\Invite;
+use App\Models\User;
+use App\Socialite\OidcProvider;
+use Illuminate\Auth\Events\Registered;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Log;
+use Laravel\Socialite\Facades\Socialite;
+
+/**
+ * Sign-in through a generic OpenID Connect provider. Mirrors GoogleController;
+ * the ID token is kept in the session so logging out of TryPost can also end
+ * the session at the identity provider.
+ */
+class OidcController extends Controller
+{
+    use PreservesAttributionParameters, PreservesInvite;
+
+    /** Session key holding the ID token used as `id_token_hint` on logout. */
+    public const ID_TOKEN_SESSION_KEY = 'oidc.id_token';
+
+    public function redirect(Request $request): RedirectResponse
+    {
+        abort_unless(SocialAuthProvider::Oidc->isEnabled(), 404);
+
+        $this->storeAttributionParameters($request);
+        $this->storeInvite($request);
+
+        return Socialite::driver('oidc')->redirect();
+    }
+
+    public function callback(Request $request): RedirectResponse
+    {
+        abort_unless(SocialAuthProvider::Oidc->isEnabled(), 404);
+
+        $driver = Socialite::driver('oidc');
+
+        try {
+            $oidcUser = $driver->user();
+        } catch (\Exception $e) {
+            // Misconfigured providers are painful to debug from a generic
+            // error page, so keep the reason in the log.
+            Log::warning('OIDC login failed: '.$e->getMessage());
+
+            return redirect()->route('login')->withErrors([
+                'email' => __('auth.oidc_failed'),
+            ]);
+        }
+
+        if (! $this->groupsAllow($oidcUser)) {
+            return redirect()->route('login')->withErrors([
+                'email' => __('auth.oidc_group_denied'),
+            ]);
+        }
+
+        if (blank($oidcUser->getEmail())) {
+            return redirect()->route('login')->withErrors([
+                'email' => __('auth.oidc_email_missing'),
+            ]);
+        }
+
+        if ($driver instanceof OidcProvider && filled($idToken = $driver->idToken())) {
+            $request->session()->put(self::ID_TOKEN_SESSION_KEY, $idToken);
+        }
+
+        // `guest` middleware gates login/signup; `auth` gates the settings connect flow.
+        if (Auth::check()) {
+            return $this->connectToCurrentUser(Auth::user(), $oidcUser->getId());
+        }
+
+        $user = User::where('oidc_id', $oidcUser->getId())->first();
+
+        if (! $user) {
+            // Matching on the email address is how someone with a local account
+            // moves over to SSO. An address the provider has not verified must
+            // not be able to do that, or anyone able to sign up there with
+            // someone else's address could walk into their account. Signing in
+            // is still fine - it just creates a separate account.
+            $byEmail = User::where('email', $oidcUser->getEmail())->first();
+
+            if ($byEmail && data_get($oidcUser->getRaw(), 'email_verified') === false) {
+                return redirect()->route('login')->withErrors([
+                    'email' => __('auth.oidc_email_unverified'),
+                ]);
+            }
+
+            $user = $byEmail;
+        }
+
+        if ($user) {
+            return $this->loginExistingUser($user, $oidcUser->getId(), $this->groupsOf($oidcUser));
+        }
+
+        return $this->registerNewUser($oidcUser, $this->groupsOf($oidcUser));
+    }
+
+    private function connectToCurrentUser(User $user, string $oidcId): RedirectResponse
+    {
+        $existing = User::where('oidc_id', $oidcId)
+            ->where('id', '!=', $user->id)
+            ->first();
+
+        if ($existing) {
+            return redirect()->route('app.authentication.edit')
+                ->with('flash.error', __('settings.authentication.providers.flash_already_linked', ['provider' => SocialAuthProvider::Oidc->label()]));
+        }
+
+        if ($user->oidc_id !== $oidcId) {
+            $user->update(['oidc_id' => $oidcId]);
+        }
+
+        return redirect()->route('app.authentication.edit')
+            ->with('flash.success', __('settings.authentication.providers.flash_connected', ['provider' => SocialAuthProvider::Oidc->label()]));
+    }
+
+    /**
+     * @param  array<int, string>  $groups
+     */
+    private function loginExistingUser(User $user, string $oidcId, array $groups = []): RedirectResponse
+    {
+        if (! $user->oidc_id) {
+            $user->update(['oidc_id' => $oidcId]);
+        }
+
+        // Roles follow the provider on every sign-in, so revoking admin there
+        // takes effect here without anyone touching the application.
+        ReleaseAccountOwnership::execute($user);
+        SyncOidcWorkspaceRole::execute($user->fresh(), $groups);
+
+        if (! $user->hasVerifiedEmail()) {
+            $user->markEmailAsVerified();
+        }
+
+        Auth::login($user, remember: true);
+
+        // New session id on privilege change, so a session id planted before
+        // login cannot be reused afterwards.
+        request()->session()->regenerate();
+
+        $this->retrieveAttributionParameters();
+
+        if ($invite = Invite::fromId($this->retrieveInvite())) {
+            return redirect()->route('app.invites.show', $invite);
+        }
+
+        return redirect()->route('app.home');
+    }
+
+    /**
+     * Group names as reported by the provider.
+     *
+     * @return array<int, string>
+     */
+    private function groupsOf(\Laravel\Socialite\Contracts\User $oidcUser): array
+    {
+        $claim = (string) config('trypost.oidc_groups_claim', 'groups');
+        $value = data_get($oidcUser->getRaw(), $claim, []);
+
+        // Most providers send an array, some a single space- or
+        // comma-separated string. Both have to work, or group handling
+        // silently does nothing on half the providers out there.
+        if (is_string($value)) {
+            $value = preg_split('/[\s,]+/', trim($value), -1, PREG_SPLIT_NO_EMPTY) ?: [];
+        }
+
+        return array_values(array_map('strval', array_filter((array) $value, 'is_scalar')));
+    }
+
+    /**
+     * Whether the provider reported a group that is allowed to sign in. With no
+     * allow-list configured, anyone the provider lets through is welcome - the
+     * provider is then the only gate, which is the usual setup.
+     */
+    private function groupsAllow(\Laravel\Socialite\Contracts\User $oidcUser): bool
+    {
+        $allowed = array_filter(array_map(
+            'trim',
+            explode(',', (string) config('trypost.oidc_allowed_groups'))
+        ));
+
+        if ($allowed === []) {
+            return true;
+        }
+
+        return array_intersect($this->groupsOf($oidcUser), $allowed) !== [];
+    }
+
+    /**
+     * Auto-join places users on a shared account, which only ever makes sense
+     * on a single-team install - hence the self-hosted guard, so a misplaced
+     * flag cannot drop strangers into someone else's account.
+     */
+    private function autoJoinEnabled(): bool
+    {
+        return (bool) config('trypost.oidc_auto_join_enabled')
+            && (bool) config('trypost.self_hosted');
+    }
+
+    /**
+     * @param  array<int, string>  $groups
+     */
+    private function registerNewUser(\Laravel\Socialite\Contracts\User $oidcUser, array $groups = []): RedirectResponse
+    {
+        // With auto-join on, provider group membership replaces the invite, so
+        // a missing invite must not be a hard stop.
+        $invite = $this->autoJoinEnabled()
+            ? Invite::fromId($this->retrieveInvite())
+            : $this->resolveInviteForRegistration();
+
+        if ($redirect = $this->inviteEmailMismatchRedirect($invite, $oidcUser->getEmail())) {
+            return $redirect;
+        }
+
+        $attributionParameters = $this->retrieveAttributionParameters();
+
+        $user = CreateUser::execute([
+            'name' => $oidcUser->getName() ?: $oidcUser->getNickname(),
+            'email' => $oidcUser->getEmail(),
+            'oidc_id' => $oidcUser->getId(),
+            'email_verified_at' => now(),
+            // Both paths join an existing account, so neither wants the
+            // personal workspace a plain signup would create.
+            'is_invite' => $invite !== null || $this->autoJoinEnabled(),
+            'registration_ip' => request()->ip(),
+        ], $attributionParameters);
+
+        event(new Registered($user));
+
+        Auth::login($user, remember: true);
+
+        request()->session()->regenerate();
+
+        if ($invite) {
+            return redirect()->route('app.invites.show', $invite);
+        }
+
+        if ($this->autoJoinEnabled()) {
+            $role = WorkspaceRole::tryFrom((string) config('trypost.oidc_auto_join_role')) ?? WorkspaceRole::Member;
+
+            if (JoinOidcUserToAccount::execute($user, $role)) {
+                SyncOidcWorkspaceRole::execute($user->fresh(), $groups);
+
+                return redirect()->route('app.home');
+            }
+
+            // Nothing to join yet: this is the first user on a fresh instance,
+            // and the account they were just given has no workspace because
+            // auto-join suppressed it. Give them the one an ordinary signup
+            // would have created, or they land in an application with nowhere
+            // to work - and nobody can ever join them either.
+            CreateWorkspace::execute($user, ['name' => $user->name."'s Workspace"]);
+            ReleaseAccountOwnership::execute($user);
+        }
+
+        return redirect()->route('app.welcome');
+    }
+}
diff --git a/app/Http/Middleware/App/EnsurePasswordLoginEnabled.php b/app/Http/Middleware/App/EnsurePasswordLoginEnabled.php
new file mode 100644
index 000000000..bbc5c7a8a
--- /dev/null
+++ b/app/Http/Middleware/App/EnsurePasswordLoginEnabled.php
@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Middleware\App;
+
+use App\Support\Auth\LoginMethods;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+
+/**
+ * Closes the password routes when the instance runs on an identity provider
+ * only. Hiding the form in the UI is not enough - the endpoints have to be
+ * shut as well, or the form can simply be posted to directly.
+ */
+class EnsurePasswordLoginEnabled
+{
+    public function handle(Request $request, Closure $next): mixed
+    {
+        if (! LoginMethods::passwordEnabled()) {
+            throw new NotFoundHttpException;
+        }
+
+        return $next($request);
+    }
+}
diff --git a/app/Http/Middleware/App/HandleInertiaRequests.php b/app/Http/Middleware/App/HandleInertiaRequests.php
index c3b19ae05..00a3e81ce 100644
--- a/app/Http/Middleware/App/HandleInertiaRequests.php
+++ b/app/Http/Middleware/App/HandleInertiaRequests.php
@@ -13,6 +13,7 @@
 use App\Http\Resources\App\HandleInertiaRequests\AuthWorkspaceResource;
 use App\Http\Resources\App\PlanResource;
 use App\Models\Plan;
+use App\Support\Auth\LoginMethods;
 use Illuminate\Http\Request;
 use Inertia\Middleware;
 
@@ -66,6 +67,9 @@ public function share(Request $request): array
             'selfHosted' => $isSelfHosted,
             'googleAuthEnabled' => SocialAuthProvider::Google->isEnabled(),
             'githubAuthEnabled' => SocialAuthProvider::GitHub->isEnabled(),
+            'oidcAuthEnabled' => SocialAuthProvider::Oidc->isEnabled(),
+            'oidcDisplayName' => SocialAuthProvider::Oidc->label(),
+            'passwordLoginEnabled' => LoginMethods::passwordEnabled(),
         ];
     }
 
diff --git a/app/Models/User.php b/app/Models/User.php
index 80b0446c4..d2c5cb843 100644
--- a/app/Models/User.php
+++ b/app/Models/User.php
@@ -39,6 +39,7 @@ class User extends Authenticatable implements HasLocalePreference, MustVerifyEma
         'password',
         'google_id',
         'github_id',
+        'oidc_id',
         'account_id',
         'current_workspace_id',
         'email_verified_at',
diff --git a/app/Providers/AppServiceProvider.php b/app/Providers/AppServiceProvider.php
index f4071b958..a8abc791d 100644
--- a/app/Providers/AppServiceProvider.php
+++ b/app/Providers/AppServiceProvider.php
@@ -32,6 +32,7 @@
 use App\Socialite\DiscordProvider;
 use App\Socialite\InstagramProvider;
 use App\Socialite\LinkedInPageExtendSocialite;
+use App\Socialite\OidcProvider;
 use Carbon\CarbonImmutable;
 use Illuminate\Auth\Notifications\ResetPassword;
 use Illuminate\Auth\Notifications\VerifyEmail;
@@ -190,6 +191,14 @@ protected function configureSocialite(): void
             return Socialite::buildProvider(InstagramProvider::class, $config);
         });
 
+        // Generic OpenID Connect (login/signup) - endpoints come from the
+        // provider's discovery document.
+        Socialite::extend('oidc', function ($app) {
+            $config = $app['config']['services.oidc'];
+
+            return Socialite::buildProvider(OidcProvider::class, $config);
+        });
+
         Socialite::extend('discord', function ($app) {
             $config = $app['config']['services.discord'];
 
diff --git a/app/Socialite/OidcProvider.php b/app/Socialite/OidcProvider.php
new file mode 100644
index 000000000..fb783ff4c
--- /dev/null
+++ b/app/Socialite/OidcProvider.php
@@ -0,0 +1,320 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Socialite;
+
+use Firebase\JWT\JWK;
+use Firebase\JWT\JWT;
+use Firebase\JWT\Key;
+use GuzzleHttp\RequestOptions;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Str;
+use Laravel\Socialite\Two\AbstractProvider;
+use Laravel\Socialite\Two\ProviderInterface;
+use Laravel\Socialite\Two\User;
+use RuntimeException;
+use Throwable;
+
+/**
+ * Generic OpenID Connect login, so any spec-compliant identity provider
+ * (Authentik, Keycloak, Pocket ID, Zitadel, Entra ID, ...) can sign users in
+ * without needing its own driver. Endpoints are read from the provider's
+ * discovery document rather than configured one by one.
+ *
+ * On top of the plain OAuth2 flow Socialite gives us:
+ *  - PKCE (S256) on every authorization request,
+ *  - a per-request nonce that has to come back inside the ID token,
+ *  - the ID token verified against the provider's JWKS, plus issuer, audience
+ *    and expiry checks.
+ */
+class OidcProvider extends AbstractProvider implements ProviderInterface
+{
+    protected $scopeSeparator = ' ';
+
+    protected $usesPKCE = true;
+
+    /**
+     * Where the nonce waits while the user is at the identity provider. It is
+     * pulled (and thereby consumed) when the ID token is validated, so a token
+     * cannot be replayed against a later login attempt.
+     */
+    private const NONCE_SESSION_KEY = 'oidc.nonce';
+
+    /**
+     * The token endpoint response of the current exchange, kept so the
+     * controller can stash the ID token for RP-initiated logout.
+     *
+     * @var array<string, mixed>
+     */
+    private array $tokenResponse = [];
+
+    /**
+     * Verified claims of the current ID token. Some providers put group
+     * membership only in here and not in the userinfo response.
+     *
+     * @var array<string, mixed>
+     */
+    private array $idTokenClaims = [];
+
+    /**
+     * The provider's discovery document. Cached per issuer because it changes
+     * rarely and every login would otherwise pay for the extra round-trip.
+     *
+     * @return array<string, mixed>
+     */
+    public function discovery(): array
+    {
+        $url = $this->discoveryUrl();
+
+        return Cache::remember('oidc.discovery.'.md5($url), now()->addHour(), function () use ($url): array {
+            $document = json_decode((string) $this->getHttpClient()->get($url, [
+                RequestOptions::HEADERS => ['Accept' => 'application/json'],
+            ])->getBody(), true);
+
+            if (! is_array($document) || blank($document['authorization_endpoint'] ?? null) || blank($document['token_endpoint'] ?? null)) {
+                throw new RuntimeException("The OIDC discovery document at {$url} is missing required endpoints.");
+            }
+
+            return $document;
+        });
+    }
+
+    /**
+     * The provider's logout endpoint, or null when it does not offer one.
+     */
+    public function endSessionEndpoint(): ?string
+    {
+        try {
+            $endpoint = $this->discovery()['end_session_endpoint'] ?? null;
+        } catch (Throwable) {
+            return null;
+        }
+
+        return is_string($endpoint) && filled($endpoint) ? $endpoint : null;
+    }
+
+    /**
+     * The ID token of the exchange that just happened, for use as
+     * `id_token_hint` on logout.
+     */
+    public function idToken(): ?string
+    {
+        $idToken = $this->tokenResponse['id_token'] ?? null;
+
+        return is_string($idToken) ? $idToken : null;
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    public function getScopes(): array
+    {
+        $configured = (string) config('services.oidc.scopes', '');
+
+        $scopes = filled($configured)
+            ? (array) preg_split('/[\s,]+/', trim($configured), -1, PREG_SPLIT_NO_EMPTY)
+            : ['profile', 'email'];
+
+        // `openid` is what makes this an OIDC request at all, so it is never
+        // left to configuration.
+        return array_values(array_unique(['openid', ...$scopes]));
+    }
+
+    protected function getAuthUrl($state): string
+    {
+        return $this->buildAuthUrlFromBase($this->discovery()['authorization_endpoint'], $state);
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    protected function getCodeFields($state = null): array
+    {
+        $nonce = Str::random(40);
+
+        $this->request->session()->put(self::NONCE_SESSION_KEY, $nonce);
+
+        return array_merge(parent::getCodeFields($state), ['nonce' => $nonce]);
+    }
+
+    protected function getTokenUrl(): string
+    {
+        return $this->discovery()['token_endpoint'];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function getAccessTokenResponse($code): array
+    {
+        $this->tokenResponse = parent::getAccessTokenResponse($code);
+
+        $this->validateIdToken($this->tokenResponse['id_token'] ?? null);
+
+        return $this->tokenResponse;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    protected function getUserByToken($token): array
+    {
+        $endpoint = $this->discovery()['userinfo_endpoint'] ?? null;
+
+        if (blank($endpoint)) {
+            throw new RuntimeException('The identity provider does not expose a userinfo endpoint.');
+        }
+
+        $claims = json_decode((string) $this->getHttpClient()->get($endpoint, [
+            RequestOptions::HEADERS => [
+                'Accept' => 'application/json',
+                'Authorization' => 'Bearer '.$token,
+            ],
+        ])->getBody(), true);
+
+        $claims = is_array($claims) ? $claims : [];
+
+        // Claims that only the ID token carries (commonly `groups`) would
+        // otherwise be lost, so fill in whatever userinfo did not return.
+        return $claims + $this->idTokenClaims;
+    }
+
+    /**
+     * @param  array<string, mixed>  $user
+     */
+    protected function mapUserToObject(array $user): User
+    {
+        $id = data_get($user, 'sub');
+
+        // Without a subject there is nothing stable to tie the account to, so
+        // fail instead of creating a user that can never log in again.
+        if (blank($id)) {
+            throw new RuntimeException('The identity provider did not return a subject claim.');
+        }
+
+        return (new User)->setRaw($user)->map([
+            'id' => (string) $id,
+            'nickname' => data_get($user, 'preferred_username'),
+            'name' => data_get($user, 'name') ?: trim((string) data_get($user, 'given_name').' '.(string) data_get($user, 'family_name')) ?: data_get($user, 'preferred_username'),
+            'email' => data_get($user, 'email'),
+            'avatar' => data_get($user, 'picture'),
+        ]);
+    }
+
+    private function discoveryUrl(): string
+    {
+        $configured = (string) config('services.oidc.discovery_url', '');
+
+        if (blank($configured)) {
+            throw new RuntimeException('OIDC_DISCOVERY_URL is not configured.');
+        }
+
+        // Accept a bare issuer URL as well; the well-known path is always the
+        // same and pasting the issuer is the easier thing to get right.
+        return Str::contains($configured, '/.well-known/')
+            ? $configured
+            : rtrim($configured, '/').'/.well-known/openid-configuration';
+    }
+
+    /**
+     * Verifies the ID token's signature and the claims that bind it to this
+     * client and this login attempt.
+     */
+    private function validateIdToken(mixed $idToken): void
+    {
+        if (! is_string($idToken) || blank($idToken)) {
+            throw new RuntimeException('The identity provider did not return an ID token.');
+        }
+
+        $expectedNonce = $this->request->session()->pull(self::NONCE_SESSION_KEY);
+
+        $claims = $this->decodeIdToken($idToken);
+
+        $issuer = $this->discovery()['issuer'] ?? null;
+
+        if (filled($issuer) && ($claims['iss'] ?? null) !== $issuer) {
+            throw new RuntimeException('The ID token was issued by a different provider than configured.');
+        }
+
+        if (! in_array($this->clientId, (array) ($claims['aud'] ?? []), true)) {
+            throw new RuntimeException('The ID token was not issued for this client.');
+        }
+
+        if (! is_string($expectedNonce) || ! hash_equals($expectedNonce, (string) ($claims['nonce'] ?? ''))) {
+            throw new RuntimeException('The ID token nonce does not match this login attempt.');
+        }
+
+        $this->idTokenClaims = $claims;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function decodeIdToken(string $idToken): array
+    {
+        // A little leeway so a clock a few seconds out of step does not lock
+        // people out. Restored afterwards because it is global to the library.
+        $previousLeeway = JWT::$leeway;
+        JWT::$leeway = 60;
+
+        try {
+            try {
+                return $this->decodeWith($idToken, $this->signingKeys());
+            } catch (Throwable) {
+                // A provider that just rotated its signing keys would otherwise
+                // lock everyone out until the cache expires, so try once more
+                // with freshly fetched keys before giving up.
+                return $this->decodeWith($idToken, $this->signingKeys(refresh: true));
+            }
+        } catch (Throwable $e) {
+            throw new RuntimeException('The ID token could not be verified: '.$e->getMessage(), previous: $e);
+        } finally {
+            JWT::$leeway = $previousLeeway;
+        }
+    }
+
+    /**
+     * @param  array<string, Key>  $keys
+     * @return array<string, mixed>
+     */
+    private function decodeWith(string $idToken, array $keys): array
+    {
+        return (array) json_decode(json_encode(JWT::decode($idToken, $keys)), true);
+    }
+
+    /**
+     * @return array<string, Key>
+     */
+    private function signingKeys(bool $refresh = false): array
+    {
+        $jwksUri = $this->discovery()['jwks_uri'] ?? null;
+
+        if (blank($jwksUri)) {
+            throw new RuntimeException('The identity provider does not publish a JWKS, so ID tokens cannot be verified.');
+        }
+
+        $cacheKey = 'oidc.jwks.'.md5((string) $jwksUri);
+
+        if ($refresh) {
+            Cache::forget($cacheKey);
+        }
+
+        // Cache the raw document rather than the parsed key set: parsed keys
+        // hold OpenSSL key objects, which no cache store can serialize.
+        // Parsing again on every login is cheap by comparison.
+        $jwks = Cache::remember($cacheKey, now()->addHour(), function () use ($jwksUri): array {
+            $document = json_decode((string) $this->getHttpClient()->get($jwksUri, [
+                RequestOptions::HEADERS => ['Accept' => 'application/json'],
+            ])->getBody(), true);
+
+            if (! is_array($document) || blank($document['keys'] ?? null)) {
+                throw new RuntimeException("The JWKS at {$jwksUri} is empty.");
+            }
+
+            return $document;
+        });
+
+        return JWK::parseKeySet($jwks);
+    }
+}
diff --git a/app/Support/Auth/LoginMethods.php b/app/Support/Auth/LoginMethods.php
new file mode 100644
index 000000000..a91ca4c76
--- /dev/null
+++ b/app/Support/Auth/LoginMethods.php
@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Support\Auth;
+
+use App\Enums\Auth\SocialAuthProvider;
+
+/**
+ * Which ways into the application are open. Instances that put an identity
+ * provider in front usually want the local password form gone, so the only way
+ * in is the one their policies actually cover.
+ */
+class LoginMethods
+{
+    /**
+     * Whether email and password sign-in is available.
+     *
+     * Switching it off is ignored while no other provider is configured: an
+     * instance must never be able to lock everybody out through a single
+     * environment variable.
+     */
+    public static function passwordEnabled(): bool
+    {
+        if ((bool) config('trypost.password_login_enabled')) {
+            return true;
+        }
+
+        return ! self::anySocialEnabled();
+    }
+
+    public static function anySocialEnabled(): bool
+    {
+        foreach (SocialAuthProvider::cases() as $provider) {
+            if ($provider->isEnabled()) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+}
diff --git a/bootstrap/app.php b/bootstrap/app.php
index 5bdd356a7..0c78a6b83 100644
--- a/bootstrap/app.php
+++ b/bootstrap/app.php
@@ -3,6 +3,7 @@
 declare(strict_types=1);
 
 use App\Http\Middleware\Api\LoadWorkspaceFromToken;
+use App\Http\Middleware\App\EnsurePasswordLoginEnabled;
 use App\Http\Middleware\App\EnsureRegistrationEnabled;
 use App\Http\Middleware\App\HandleInertiaRequests;
 use App\Http\Middleware\App\SetLocale;
@@ -37,6 +38,7 @@
         $middleware->alias([
             'workspace.token' => LoadWorkspaceFromToken::class,
             'registration.enabled' => EnsureRegistrationEnabled::class,
+            'password.login.enabled' => EnsurePasswordLoginEnabled::class,
         ]);
 
         $middleware->preventRequestForgery(except: [
diff --git a/composer.json b/composer.json
index e86d17de6..0418ac690 100644
--- a/composer.json
+++ b/composer.json
@@ -41,6 +41,7 @@
         "laravel/boost": "^2.5",
         "laravel/cashier": "^16.2",
         "laravel/framework": "^13.0",
+        "firebase/php-jwt": "^7.0",
         "laravel/horizon": "^5.45",
         "laravel/mcp": "^0.9.1",
         "laravel/nightwatch": "^1.22",
diff --git a/composer.lock b/composer.lock
index f3dea7766..a295fa39e 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "ef65b49279941f3458f444863f0ce6e4",
+    "content-hash": "5e8e8d47a119032b01c3ee780251bdf1",
     "packages": [
         {
             "name": "aws/aws-crt-php",
diff --git a/config/services.php b/config/services.php
index 4b5d5690f..927f467ab 100644
--- a/config/services.php
+++ b/config/services.php
@@ -75,6 +75,16 @@
         'redirect' => env('GOOGLE_AUTH_CALLBACK'),
     ],
 
+    // Generic OpenID Connect (used for login/signup)
+    'oidc' => [
+        'client_id' => env('OIDC_CLIENT_ID'),
+        'client_secret' => env('OIDC_CLIENT_SECRET'),
+        'redirect' => env('OIDC_AUTH_CALLBACK'),
+        // Either the issuer URL or the full .well-known URL.
+        'discovery_url' => env('OIDC_DISCOVERY_URL'),
+        'scopes' => env('OIDC_SCOPES', 'openid profile email'),
+    ],
+
     // GitHub OAuth (used for login/signup)
     'github' => [
         'client_id' => env('GITHUB_CLIENT_ID'),
diff --git a/config/trypost.php b/config/trypost.php
index aed84cd6b..cd621991d 100644
--- a/config/trypost.php
+++ b/config/trypost.php
@@ -157,6 +157,39 @@
 
     'github_auth_enabled' => env('GITHUB_AUTH_ENABLED', false),
 
+    // Instances behind an identity provider usually want the local password
+    // form gone. Ignored while no other provider is configured, so a single
+    // variable can never lock everybody out.
+    'password_login_enabled' => env('PASSWORD_LOGIN_ENABLED', true),
+
+    'oidc_auth_enabled' => env('OIDC_AUTH_ENABLED', false),
+    'oidc_display_name' => env('OIDC_DISPLAY_NAME', 'SSO'),
+    // Ends the session at the identity provider too, so logging out really
+    // logs out instead of silently signing straight back in.
+    'oidc_logout_enabled' => env('OIDC_LOGOUT_ENABLED', true),
+    // Where the provider sends the browser after logout. Leave empty unless
+    // the exact same URI is registered with the provider - a mismatch makes
+    // providers reject the logout entirely.
+    'oidc_post_logout_redirect_uri' => env('OIDC_POST_LOGOUT_REDIRECT_URI'),
+    // Group handling. The claim is whatever the provider puts the group names
+    // in; allowed_groups gates who may sign in at all.
+    'oidc_groups_claim' => env('OIDC_GROUPS_CLAIM', 'groups'),
+    'oidc_allowed_groups' => env('OIDC_ALLOWED_GROUPS', ''),
+    // Self-hosted teams usually want provider group membership to be the only
+    // onboarding step, so new OIDC users can be placed on the shared account
+    // instead of needing a separate invite each.
+    'oidc_auto_join_enabled' => env('OIDC_AUTO_JOIN_ENABLED', false),
+    'oidc_auto_join_role' => env('OIDC_AUTO_JOIN_ROLE', 'member'),
+    // Groups whose members administer the workspace. Set this and the role of
+    // every OIDC user follows the provider on each sign-in, which is what lets
+    // an instance run without a standing local admin account.
+    'oidc_admin_groups' => env('OIDC_ADMIN_GROUPS', ''),
+    // Hand the account over to group management entirely by clearing its
+    // owner. Ownership outranks the workspace role, so whoever holds it sits
+    // outside the group system for good.
+    'oidc_release_ownership' => env('OIDC_RELEASE_OWNERSHIP', false),
+    'oidc_auto_join_account_id' => env('OIDC_AUTO_JOIN_ACCOUNT_ID'),
+
     /*
     |--------------------------------------------------------------------------
     | Social Platforms
diff --git a/database/factories/UserFactory.php b/database/factories/UserFactory.php
index 87f61894d..af4fe367b 100644
--- a/database/factories/UserFactory.php
+++ b/database/factories/UserFactory.php
@@ -35,6 +35,7 @@ public function definition(): array
             'password' => static::$password ??= Hash::make('password'),
             'google_id' => null,
             'github_id' => null,
+            'oidc_id' => null,
             'remember_token' => Str::random(10),
             'account_id' => Account::factory(),
             'current_workspace_id' => null,
diff --git a/database/migrations/2026_09_14_120000_add_oidc_id_to_users_table.php b/database/migrations/2026_09_14_120000_add_oidc_id_to_users_table.php
new file mode 100644
index 000000000..9f2d40222
--- /dev/null
+++ b/database/migrations/2026_09_14_120000_add_oidc_id_to_users_table.php
@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table): void {
+            $table->string('oidc_id')->nullable()->unique()->after('github_id');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table): void {
+            $table->dropColumn('oidc_id');
+        });
+    }
+};
diff --git a/lang/ar/auth.php b/lang/ar/auth.php
index 947e75271..e0467b745 100644
--- a/lang/ar/auth.php
+++ b/lang/ar/auth.php
@@ -55,11 +55,18 @@
     'google_signup' => 'التسجيل عبر Google',
     'github_login' => 'تسجيل الدخول عبر GitHub',
     'github_signup' => 'التسجيل عبر GitHub',
+    'oidc_login' => 'تسجيل الدخول عبر :provider',
+    'oidc_signup' => 'التسجيل عبر :provider',
+    'oidc_group_denied' => 'حسابك ليس ضمن أي مجموعة مسموح لها باستخدام هذا التطبيق.',
+    'oidc_email_missing' => 'لم يرسل مزوّد الهوية الخاص بك أي عنوان بريد إلكتروني.',
+    'oidc_email_unverified' => 'عنوان بريدك الإلكتروني غير موثّق لدى مزوّد الهوية الخاص بك.',
+    'oidc_failed' => 'فشل تسجيل الدخول الموحّد. يرجى المحاولة مرة أخرى.',
     'github_email_unavailable' => 'تعذر جلب بريدك الإلكتروني من GitHub. اجعل بريدك على GitHub عامًا أو امنح نطاق الوصول إلى البريد، ثم حاول مرة أخرى.',
 
     'login' => [
         'title' => 'تسجيل الدخول إلى حسابك',
         'description' => 'أدخل بريدك الإلكتروني وكلمة المرور أدناه لتسجيل الدخول',
+        'description_without_password' => 'سجّل الدخول باستخدام حساب مؤسستك للمتابعة',
         'page_title' => 'تسجيل الدخول',
         'email' => 'البريد الإلكتروني',
         'password' => 'كلمة المرور',
diff --git a/lang/de/auth.php b/lang/de/auth.php
index d3d446bda..af6aab867 100644
--- a/lang/de/auth.php
+++ b/lang/de/auth.php
@@ -57,11 +57,18 @@
     'google_signup' => 'Mit Google registrieren',
     'github_login' => 'Mit GitHub anmelden',
     'github_signup' => 'Mit GitHub registrieren',
+    'oidc_login' => 'Mit :provider anmelden',
+    'oidc_signup' => 'Mit :provider registrieren',
+    'oidc_group_denied' => 'Dein Konto ist in keiner Gruppe, die diese Anwendung nutzen darf.',
+    'oidc_email_missing' => 'Dein Anmeldedienst hat keine E-Mail-Adresse übermittelt.',
+    'oidc_email_unverified' => 'Deine E-Mail-Adresse ist bei deinem Anmeldedienst nicht bestätigt.',
+    'oidc_failed' => 'Die Anmeldung ist fehlgeschlagen. Bitte versuche es erneut.',
     'github_email_unavailable' => 'Deine E-Mail-Adresse konnte nicht von GitHub abgerufen werden. Mache deine GitHub-E-Mail-Adresse öffentlich oder erteile die Berechtigung für den E-Mail-Zugriff und versuche es dann erneut.',
 
     'login' => [
         'title' => 'Melde dich bei deinem Konto an',
         'description' => 'Gib unten deine E-Mail-Adresse und dein Passwort ein, um dich anzumelden',
+        'description_without_password' => 'Melde dich mit deinem Organisationskonto an, um fortzufahren',
         'page_title' => 'Anmelden',
         'email' => 'E-Mail-Adresse',
         'password' => 'Passwort',
diff --git a/lang/el/auth.php b/lang/el/auth.php
index d828a59e5..46f50da67 100644
--- a/lang/el/auth.php
+++ b/lang/el/auth.php
@@ -55,11 +55,18 @@
     'google_signup' => 'Εγγραφή με Google',
     'github_login' => 'Σύνδεση με GitHub',
     'github_signup' => 'Εγγραφή με GitHub',
+    'oidc_login' => 'Σύνδεση με :provider',
+    'oidc_signup' => 'Εγγραφή με :provider',
+    'oidc_group_denied' => 'Ο λογαριασμός σας δεν ανήκει σε ομάδα που επιτρέπεται να χρησιμοποιεί αυτήν την εφαρμογή.',
+    'oidc_email_missing' => 'Ο πάροχος ταυτότητάς σας δεν επέστρεψε διεύθυνση email.',
+    'oidc_email_unverified' => 'Η διεύθυνση email σας δεν είναι επαληθευμένη στον πάροχο ταυτότητάς σας.',
+    'oidc_failed' => 'Η σύνδεση απέτυχε. Δοκιμάστε ξανά.',
     'github_email_unavailable' => 'Δεν ήταν δυνατή η ανάκτηση του email σας από το GitHub. Κάντε δημόσιο το email σας στο GitHub ή παραχωρήστε το scope email και δοκιμάστε ξανά.',
 
     'login' => [
         'title' => 'Συνδεθείτε στον λογαριασμό σας',
         'description' => 'Εισάγετε το email και τον κωδικό πρόσβασής σας παρακάτω για να συνδεθείτε',
+        'description_without_password' => 'Συνδεθείτε με τον λογαριασμό του οργανισμού σας για να συνεχίσετε',
         'page_title' => 'Σύνδεση',
         'email' => 'Διεύθυνση email',
         'password' => 'Κωδικός πρόσβασης',
diff --git a/lang/en/auth.php b/lang/en/auth.php
index 79d1b5608..217369c4d 100644
--- a/lang/en/auth.php
+++ b/lang/en/auth.php
@@ -55,11 +55,18 @@
     'google_signup' => 'Sign up with Google',
     'github_login' => 'Log in with GitHub',
     'github_signup' => 'Sign up with GitHub',
+    'oidc_login' => 'Log in with :provider',
+    'oidc_signup' => 'Sign up with :provider',
+    'oidc_group_denied' => 'Your account is not in a group that may use this application.',
+    'oidc_email_missing' => 'Your identity provider did not return an email address.',
+    'oidc_email_unverified' => 'Your email address is not verified with your identity provider.',
+    'oidc_failed' => 'Single sign-on failed. Please try again.',
     'github_email_unavailable' => 'Unable to retrieve your email from GitHub. Make your GitHub email public or grant the email scope, then try again.',
 
     'login' => [
         'title' => 'Log in to your account',
         'description' => 'Enter your email and password below to log in',
+        'description_without_password' => 'Sign in with your organisation account to continue',
         'page_title' => 'Log in',
         'email' => 'Email address',
         'password' => 'Password',
diff --git a/lang/es/auth.php b/lang/es/auth.php
index 967d37d6b..aaafc40c3 100644
--- a/lang/es/auth.php
+++ b/lang/es/auth.php
@@ -43,11 +43,18 @@
     'google_signup' => 'Registrarse con Google',
     'github_login' => 'Iniciar sesión con GitHub',
     'github_signup' => 'Registrarse con GitHub',
+    'oidc_login' => 'Iniciar sesión con :provider',
+    'oidc_signup' => 'Registrarse con :provider',
+    'oidc_group_denied' => 'Tu cuenta no pertenece a ningún grupo autorizado a usar esta aplicación.',
+    'oidc_email_missing' => 'Tu proveedor de identidad no ha devuelto ninguna dirección de correo.',
+    'oidc_email_unverified' => 'Tu dirección de correo no está verificada en tu proveedor de identidad.',
+    'oidc_failed' => 'El inicio de sesión ha fallado. Inténtalo de nuevo.',
     'github_email_unavailable' => 'No fue posible obtener tu correo de GitHub. Haz tu correo público en GitHub o concede el permiso de correo y vuelve a intentar.',
 
     'login' => [
         'title' => 'Inicia sesión en tu cuenta',
         'description' => 'Introduce tu correo y contraseña para iniciar sesión',
+        'description_without_password' => 'Inicia sesión con la cuenta de tu organización para continuar',
         'page_title' => 'Iniciar sesión',
         'email' => 'Correo electrónico',
         'password' => 'Contraseña',
diff --git a/lang/fr/auth.php b/lang/fr/auth.php
index 512e78a2e..0334b851e 100644
--- a/lang/fr/auth.php
+++ b/lang/fr/auth.php
@@ -55,11 +55,18 @@
     'google_signup' => 'S\'inscrire avec Google',
     'github_login' => 'Se connecter avec GitHub',
     'github_signup' => 'S\'inscrire avec GitHub',
+    'oidc_login' => 'Se connecter avec :provider',
+    'oidc_signup' => 'S\'inscrire avec :provider',
+    'oidc_group_denied' => 'Votre compte n\'appartient à aucun groupe autorisé à utiliser cette application.',
+    'oidc_email_missing' => 'Votre fournisseur d\'identité n\'a pas transmis d\'adresse e-mail.',
+    'oidc_email_unverified' => 'Votre adresse e-mail n\'est pas vérifiée auprès de votre fournisseur d\'identité.',
+    'oidc_failed' => 'La connexion a échoué. Veuillez réessayer.',
     'github_email_unavailable' => 'Impossible de récupérer votre e-mail depuis GitHub. Rendez votre e-mail GitHub public ou accordez l\'autorisation d\'accès à l\'e-mail, puis réessayez.',
 
     'login' => [
         'title' => 'Connectez-vous à votre compte',
         'description' => 'Saisissez votre e-mail et votre mot de passe ci-dessous pour vous connecter',
+        'description_without_password' => 'Connectez-vous avec le compte de votre organisation pour continuer',
         'page_title' => 'Connexion',
         'email' => 'Adresse e-mail',
         'password' => 'Mot de passe',
diff --git a/lang/it/auth.php b/lang/it/auth.php
index 3677f507e..c35a85c3c 100644
--- a/lang/it/auth.php
+++ b/lang/it/auth.php
@@ -55,11 +55,18 @@
     'google_signup' => 'Registrati con Google',
     'github_login' => 'Accedi con GitHub',
     'github_signup' => 'Registrati con GitHub',
+    'oidc_login' => 'Accedi con :provider',
+    'oidc_signup' => 'Registrati con :provider',
+    'oidc_group_denied' => 'Il tuo account non appartiene a nessun gruppo autorizzato a usare questa applicazione.',
+    'oidc_email_missing' => 'Il tuo provider di identità non ha restituito alcun indirizzo email.',
+    'oidc_email_unverified' => 'Il tuo indirizzo email non è verificato presso il tuo provider di identità.',
+    'oidc_failed' => 'Accesso non riuscito. Riprova.',
     'github_email_unavailable' => 'Impossibile recuperare la tua email da GitHub. Rendi pubblica la tua email GitHub o concedi l\'ambito email, poi riprova.',
 
     'login' => [
         'title' => 'Accedi al tuo account',
         'description' => 'Inserisci la tua email e la password qui sotto per accedere',
+        'description_without_password' => 'Accedi con l\'account della tua organizzazione per continuare',
         'page_title' => 'Accedi',
         'email' => 'Indirizzo email',
         'password' => 'Password',
diff --git a/lang/ja/auth.php b/lang/ja/auth.php
index 53acf65ae..35e4dfd37 100644
--- a/lang/ja/auth.php
+++ b/lang/ja/auth.php
@@ -55,11 +55,18 @@
     'google_signup' => 'Google で登録',
     'github_login' => 'GitHub でログイン',
     'github_signup' => 'GitHub で登録',
+    'oidc_login' => ':provider でログイン',
+    'oidc_signup' => ':provider で登録',
+    'oidc_group_denied' => 'お使いのアカウントは、このアプリケーションを利用できるグループに所属していません。',
+    'oidc_email_missing' => 'ID プロバイダーからメールアドレスが返されませんでした。',
+    'oidc_email_unverified' => 'ID プロバイダーでメールアドレスが確認されていません。',
+    'oidc_failed' => 'シングルサインオンに失敗しました。もう一度お試しください。',
     'github_email_unavailable' => 'GitHub からメールアドレスを取得できませんでした。GitHub のメールアドレスを公開するか、email スコープを許可してから、もう一度お試しください。',
 
     'login' => [
         'title' => 'アカウントにログイン',
         'description' => 'ログインするにはメールアドレスとパスワードを入力してください',
+        'description_without_password' => '続行するには組織のアカウントでログインしてください',
         'page_title' => 'ログイン',
         'email' => 'メールアドレス',
         'password' => 'パスワード',
diff --git a/lang/ko/auth.php b/lang/ko/auth.php
index 796ef6d45..bd3a0cc53 100644
--- a/lang/ko/auth.php
+++ b/lang/ko/auth.php
@@ -55,11 +55,18 @@
     'google_signup' => 'Google로 가입하기',
     'github_login' => 'GitHub으로 로그인',
     'github_signup' => 'GitHub으로 가입하기',
+    'oidc_login' => ':provider로 로그인',
+    'oidc_signup' => ':provider로 가입하기',
+    'oidc_group_denied' => '이 애플리케이션을 사용할 수 있는 그룹에 계정이 속해 있지 않습니다.',
+    'oidc_email_missing' => 'ID 공급자가 이메일 주소를 반환하지 않았습니다.',
+    'oidc_email_unverified' => 'ID 공급자에서 이메일 주소가 확인되지 않았습니다.',
+    'oidc_failed' => '싱글 사인온에 실패했습니다. 다시 시도해 주세요.',
     'github_email_unavailable' => 'GitHub에서 이메일을 가져올 수 없습니다. GitHub 이메일을 공개로 설정하거나 이메일 권한을 부여한 후 다시 시도하세요.',
 
     'login' => [
         'title' => '계정에 로그인',
         'description' => '로그인하려면 아래에 이메일과 비밀번호를 입력하세요',
+        'description_without_password' => '계속하려면 조직 계정으로 로그인하세요',
         'page_title' => '로그인',
         'email' => '이메일 주소',
         'password' => '비밀번호',
diff --git a/lang/nl/auth.php b/lang/nl/auth.php
index 03fb7b664..39c2a3d0e 100644
--- a/lang/nl/auth.php
+++ b/lang/nl/auth.php
@@ -55,11 +55,18 @@
     'google_signup' => 'Aanmelden met Google',
     'github_login' => 'Inloggen met GitHub',
     'github_signup' => 'Aanmelden met GitHub',
+    'oidc_login' => 'Inloggen met :provider',
+    'oidc_signup' => 'Aanmelden met :provider',
+    'oidc_group_denied' => 'Je account zit niet in een groep die deze applicatie mag gebruiken.',
+    'oidc_email_missing' => 'Je identiteitsprovider heeft geen e-mailadres doorgegeven.',
+    'oidc_email_unverified' => 'Je e-mailadres is niet geverifieerd bij je identiteitsprovider.',
+    'oidc_failed' => 'Inloggen is mislukt. Probeer het opnieuw.',
     'github_email_unavailable' => 'Kan je e-mailadres niet ophalen van GitHub. Maak je GitHub-e-mailadres openbaar of verleen de e-mailscope en probeer het opnieuw.',
 
     'login' => [
         'title' => 'Log in op je account',
         'description' => 'Voer hieronder je e-mailadres en wachtwoord in om in te loggen',
+        'description_without_password' => 'Log in met je organisatieaccount om verder te gaan',
         'page_title' => 'Inloggen',
         'email' => 'E-mailadres',
         'password' => 'Wachtwoord',
diff --git a/lang/pl/auth.php b/lang/pl/auth.php
index b486f4c14..6190e0a05 100644
--- a/lang/pl/auth.php
+++ b/lang/pl/auth.php
@@ -55,11 +55,18 @@
     'google_signup' => 'Zarejestruj się przez Google',
     'github_login' => 'Zaloguj się przez GitHub',
     'github_signup' => 'Zarejestruj się przez GitHub',
+    'oidc_login' => 'Zaloguj się przez :provider',
+    'oidc_signup' => 'Zarejestruj się przez :provider',
+    'oidc_group_denied' => 'Twoje konto nie należy do grupy uprawnionej do korzystania z tej aplikacji.',
+    'oidc_email_missing' => 'Twój dostawca tożsamości nie przekazał adresu e-mail.',
+    'oidc_email_unverified' => 'Twój adres e-mail nie został zweryfikowany u dostawcy tożsamości.',
+    'oidc_failed' => 'Logowanie nie powiodło się. Spróbuj ponownie.',
     'github_email_unavailable' => 'Nie udało się pobrać Twojego adresu e-mail z GitHuba. Ustaw swój adres e-mail w GitHubie jako publiczny lub przyznaj uprawnienie do e-maila, a następnie spróbuj ponownie.',
 
     'login' => [
         'title' => 'Zaloguj się na swoje konto',
         'description' => 'Wprowadź poniżej swój e-mail i hasło, aby się zalogować',
+        'description_without_password' => 'Zaloguj się kontem swojej organizacji, aby kontynuować',
         'page_title' => 'Zaloguj się',
         'email' => 'Adres e-mail',
         'password' => 'Hasło',
diff --git a/lang/pt-BR/auth.php b/lang/pt-BR/auth.php
index 3548fd741..63e15a010 100644
--- a/lang/pt-BR/auth.php
+++ b/lang/pt-BR/auth.php
@@ -55,11 +55,18 @@
     'google_signup' => 'Cadastrar com Google',
     'github_login' => 'Entrar com GitHub',
     'github_signup' => 'Cadastrar com GitHub',
+    'oidc_login' => 'Entrar com :provider',
+    'oidc_signup' => 'Cadastrar com :provider',
+    'oidc_group_denied' => 'Sua conta não está em um grupo autorizado a usar este aplicativo.',
+    'oidc_email_missing' => 'Seu provedor de identidade não retornou um endereço de email.',
+    'oidc_email_unverified' => 'Seu endereço de email não está verificado no seu provedor de identidade.',
+    'oidc_failed' => 'Falha no login único. Tente novamente.',
     'github_email_unavailable' => 'Não foi possível obter seu e-mail do GitHub. Torne seu e-mail público ou conceda a permissão de e-mail e tente novamente.',
 
     'login' => [
         'title' => 'Entrar na sua conta',
         'description' => 'Digite seu email e senha abaixo para entrar',
+        'description_without_password' => 'Entre com a conta da sua organização para continuar',
         'page_title' => 'Entrar',
         'email' => 'Endereço de email',
         'password' => 'Senha',
diff --git a/lang/ru/auth.php b/lang/ru/auth.php
index a50349475..5acb1e3bb 100644
--- a/lang/ru/auth.php
+++ b/lang/ru/auth.php
@@ -55,11 +55,18 @@
     'google_signup' => 'Зарегистрироваться через Google',
     'github_login' => 'Войти через GitHub',
     'github_signup' => 'Зарегистрироваться через GitHub',
+    'oidc_login' => 'Войти через :provider',
+    'oidc_signup' => 'Зарегистрироваться через :provider',
+    'oidc_group_denied' => 'Ваша учётная запись не входит в группу, которой разрешено пользоваться этим приложением.',
+    'oidc_email_missing' => 'Ваш поставщик учётных данных не передал email.',
+    'oidc_email_unverified' => 'Ваш email не подтверждён у поставщика учётных данных.',
+    'oidc_failed' => 'Не удалось выполнить вход. Попробуйте ещё раз.',
     'github_email_unavailable' => 'Не удалось получить ваш email из GitHub. Сделайте email в GitHub публичным или предоставьте доступ к email, затем попробуйте снова.',
 
     'login' => [
         'title' => 'Войдите в свой аккаунт',
         'description' => 'Введите email и пароль, чтобы войти',
+        'description_without_password' => 'Войдите с учётной записью вашей организации, чтобы продолжить',
         'page_title' => 'Вход',
         'email' => 'Адрес email',
         'password' => 'Пароль',
diff --git a/lang/tr/auth.php b/lang/tr/auth.php
index a8d3d81c4..63f016985 100644
--- a/lang/tr/auth.php
+++ b/lang/tr/auth.php
@@ -57,11 +57,18 @@
     'google_signup' => 'Google ile kayıt ol',
     'github_login' => 'GitHub ile giriş yap',
     'github_signup' => 'GitHub ile kayıt ol',
+    'oidc_login' => ':provider ile giriş yap',
+    'oidc_signup' => ':provider ile kayıt ol',
+    'oidc_group_denied' => 'Hesabınız bu uygulamayı kullanabilecek bir grupta değil.',
+    'oidc_email_missing' => 'Kimlik sağlayıcınız bir e-posta adresi döndürmedi.',
+    'oidc_email_unverified' => 'E-posta adresiniz kimlik sağlayıcınızda doğrulanmamış.',
+    'oidc_failed' => 'Çoklu oturum açma başarısız oldu. Lütfen tekrar deneyin.',
     'github_email_unavailable' => 'GitHub\'dan e-postanız alınamadı. GitHub e-postanızı herkese açık yapın veya e-posta iznini verin, ardından tekrar deneyin.',
 
     'login' => [
         'title' => 'Hesabınıza giriş yapın',
         'description' => 'Giriş yapmak için e-posta ve parolanızı aşağıya girin',
+        'description_without_password' => 'Devam etmek için kurum hesabınızla giriş yapın',
         'page_title' => 'Giriş yap',
         'email' => 'E-posta adresi',
         'password' => 'Parola',
diff --git a/lang/uk/auth.php b/lang/uk/auth.php
index 8aa200bb1..070d9479c 100644
--- a/lang/uk/auth.php
+++ b/lang/uk/auth.php
@@ -55,11 +55,18 @@
     'google_signup' => 'Зареєструватися через Google',
     'github_login' => 'Увійти через GitHub',
     'github_signup' => 'Зареєструватися через GitHub',
+    'oidc_login' => 'Увійти через :provider',
+    'oidc_signup' => 'Зареєструватися через :provider',
+    'oidc_group_denied' => 'Ваш обліковий запис не належить до групи, якій дозволено користуватися цим застосунком.',
+    'oidc_email_missing' => 'Ваш постачальник ідентифікації не передав email.',
+    'oidc_email_unverified' => 'Ваш email не підтверджено в постачальника ідентифікації.',
+    'oidc_failed' => 'Не вдалося увійти. Спробуйте ще раз.',
     'github_email_unavailable' => 'Не вдалося отримати ваш email з GitHub. Зробіть email публічним або надайте доступ до email, потім спробуйте ще раз.',
 
     'login' => [
         'title' => 'Увійдіть до облікового запису',
         'description' => 'Введіть email і пароль нижче, щоб увійти',
+        'description_without_password' => 'Увійдіть за допомогою облікового запису вашої організації, щоб продовжити',
         'page_title' => 'Вхід',
         'email' => 'Адреса email',
         'password' => 'Пароль',
diff --git a/lang/zh/auth.php b/lang/zh/auth.php
index ce799a35c..1c84e27b3 100644
--- a/lang/zh/auth.php
+++ b/lang/zh/auth.php
@@ -55,11 +55,18 @@
     'google_signup' => '使用 Google 注册',
     'github_login' => '使用 GitHub 登录',
     'github_signup' => '使用 GitHub 注册',
+    'oidc_login' => '使用 :provider 登录',
+    'oidc_signup' => '使用 :provider 注册',
+    'oidc_group_denied' => '你的账户不属于任何可以使用此应用的群组。',
+    'oidc_email_missing' => '你的身份提供商未返回邮箱地址。',
+    'oidc_email_unverified' => '你的邮箱地址尚未在身份提供商处验证。',
+    'oidc_failed' => '单点登录失败，请重试。',
     'github_email_unavailable' => '无法从 GitHub 获取你的邮箱。请将你的 GitHub 邮箱设为公开，或授予邮箱权限后重试。',
 
     'login' => [
         'title' => '登录你的账户',
         'description' => '请在下方输入你的邮箱和密码以登录',
+        'description_without_password' => '请使用你的组织账户登录以继续',
         'page_title' => '登录',
         'email' => '邮箱地址',
         'password' => '密码',
diff --git a/resources/js/components/auth/SocialLogin.vue b/resources/js/components/auth/SocialLogin.vue
index c2159938f..a682312c3 100644
--- a/resources/js/components/auth/SocialLogin.vue
+++ b/resources/js/components/auth/SocialLogin.vue
@@ -1,10 +1,12 @@
 <script setup lang="ts">
+import { IconKey } from '@tabler/icons-vue';
 import { usePage } from '@inertiajs/vue3';
 import { computed } from 'vue';
 
 import { Button } from '@/components/ui/button';
 import { redirect as githubRedirect } from '@/routes/auth/github';
 import { redirect as googleRedirect } from '@/routes/auth/google';
+import { redirect as oidcRedirect } from '@/routes/auth/oidc';
 
 const props = withDefaults(
     defineProps<{
@@ -18,7 +20,9 @@ const props = withDefaults(
 const page = usePage();
 const googleEnabled = computed(() => Boolean(page.props.googleAuthEnabled));
 const githubEnabled = computed(() => Boolean(page.props.githubAuthEnabled));
-const hasSocial = computed(() => googleEnabled.value || githubEnabled.value);
+const oidcEnabled = computed(() => Boolean(page.props.oidcAuthEnabled));
+const oidcLabel = computed(() => String(page.props.oidcDisplayName || 'SSO'));
+const hasSocial = computed(() => googleEnabled.value || githubEnabled.value || oidcEnabled.value);
 
 const query = computed(() => {
     const params: Record<string, string> = {};
@@ -28,6 +32,7 @@ const query = computed(() => {
 
 const googleUrl = computed(() => googleRedirect.url({ query: query.value }));
 const githubUrl = computed(() => githubRedirect.url({ query: query.value }));
+const oidcUrl = computed(() => oidcRedirect.url({ query: query.value }));
 </script>
 
 <template>
@@ -42,6 +47,11 @@ const githubUrl = computed(() => githubRedirect.url({ query: query.value }));
                 <img src="/images/social/github.svg" alt="GitHub" class="size-4 dark:invert" />
                 {{ mode === 'login' ? $t('auth.github_login') : $t('auth.github_signup') }}
             </Button>
+
+            <Button v-if="oidcEnabled" variant="outline" class="w-full" as="a" :href="oidcUrl">
+                <IconKey class="size-4" />
+                {{ mode === 'login' ? $t('auth.oidc_login', { provider: oidcLabel }) : $t('auth.oidc_signup', { provider: oidcLabel }) }}
+            </Button>
         </div>
 
         <div
diff --git a/resources/js/pages/auth/Login.vue b/resources/js/pages/auth/Login.vue
index 2a50baccb..046512a3c 100644
--- a/resources/js/pages/auth/Login.vue
+++ b/resources/js/pages/auth/Login.vue
@@ -37,13 +37,20 @@ const showPassword = ref(false);
 
 const page = usePage();
 const isSelfHosted = computed(() => Boolean(page.props.selfHosted));
+const passwordLoginEnabled = computed(() =>
+    Boolean(page.props.passwordLoginEnabled),
+);
 const pageErrors = usePageErrors();
 </script>
 
 <template>
     <AuthBase
         :title="$t('auth.login.title')"
-        :description="$t('auth.login.description')"
+        :description="
+            passwordLoginEnabled
+                ? $t('auth.login.description')
+                : $t('auth.login.description_without_password')
+        "
     >
         <Head :title="$t('auth.login.page_title')" />
 
@@ -55,9 +62,14 @@ const pageErrors = usePageErrors();
         </div>
 
         <div class="flex flex-col gap-6">
-            <SocialLogin mode="login" :invite="invite" />
+            <SocialLogin
+                mode="login"
+                :invite="invite"
+                :hide-divider="!passwordLoginEnabled"
+            />
 
             <Form
+                v-if="passwordLoginEnabled"
                 v-bind="store.form()"
                 :reset-on-success="['password']"
                 v-slot="{ errors, processing }"
diff --git a/resources/js/pages/auth/Register.vue b/resources/js/pages/auth/Register.vue
index 008fdb91a..7a72193f3 100644
--- a/resources/js/pages/auth/Register.vue
+++ b/resources/js/pages/auth/Register.vue
@@ -33,6 +33,9 @@ const showPassword = ref(false);
 const showEmailForm = ref(false);
 
 const page = usePage();
+const passwordLoginEnabled = computed(() =>
+    Boolean(page.props.passwordLoginEnabled),
+);
 const hasSocial = computed(
     () =>
         Boolean(page.props.googleAuthEnabled) ||
@@ -56,7 +59,7 @@ const emailFormVisible = computed(() => !hasSocial.value || showEmailForm.value)
                 <SocialLogin mode="signup" hide-divider :invite="invite" />
 
                 <Button
-                    v-if="!showEmailForm"
+                    v-if="!showEmailForm && passwordLoginEnabled"
                     type="button"
                     variant="outline"
                     class="w-full"
@@ -68,6 +71,7 @@ const emailFormVisible = computed(() => !hasSocial.value || showEmailForm.value)
             </div>
 
             <Form
+                v-if="passwordLoginEnabled"
                 v-bind="store.form()"
                 :reset-on-success="['password']"
                 v-slot="{ errors, processing }"
diff --git a/routes/auth.php b/routes/auth.php
index c8d7817d4..03b516b73 100644
--- a/routes/auth.php
+++ b/routes/auth.php
@@ -9,6 +9,7 @@
 use App\Http\Controllers\Auth\GitHubController;
 use App\Http\Controllers\Auth\GoogleController;
 use App\Http\Controllers\Auth\NewPasswordController;
+use App\Http\Controllers\Auth\OidcController;
 use App\Http\Controllers\Auth\PasswordResetLinkController;
 use App\Http\Controllers\Auth\RegisteredUserController;
 use App\Http\Controllers\Auth\VerifyEmailController;
@@ -18,21 +19,37 @@
 
 Route::middleware(['guest'])->group(function () {
     Route::middleware('registration.enabled')->group(function () {
+        // The page itself stays reachable with password sign-in off - it is
+        // where the provider buttons live - but creating an account with a
+        // password it could never be used with does not.
         Route::get('/register', [RegisteredUserController::class, 'create'])->name('register');
-        Route::post('/register', [RegisteredUserController::class, 'store'])->name('register.store');
+        Route::post('/register', [RegisteredUserController::class, 'store'])
+            ->middleware('password.login.enabled')
+            ->name('register.store');
     });
 
+    // The login page itself stays reachable with password sign-in switched
+    // off - it is where the provider buttons live.
     Route::get('/login', [AuthenticatedSessionController::class, 'create'])->name('login');
-    Route::post('/login', [AuthenticatedSessionController::class, 'store'])->name('login.store');
 
-    Route::get('/forgot-password', [PasswordResetLinkController::class, 'create'])->name('password.request');
-    Route::post('/forgot-password', [PasswordResetLinkController::class, 'store'])->name('password.email');
+    Route::middleware('password.login.enabled')->group(function () {
+        Route::post('/login', [AuthenticatedSessionController::class, 'store'])->name('login.store');
 
-    Route::get('/reset-password/{token}', [NewPasswordController::class, 'create'])->name('password.reset');
-    Route::post('/reset-password', [NewPasswordController::class, 'store'])->name('password.store');
+        Route::get('/forgot-password', [PasswordResetLinkController::class, 'create'])->name('password.request');
+        Route::post('/forgot-password', [PasswordResetLinkController::class, 'store'])->name('password.email');
+
+        Route::get('/reset-password/{token}', [NewPasswordController::class, 'create'])->name('password.reset');
+        Route::post('/reset-password', [NewPasswordController::class, 'store'])->name('password.store');
+    });
 
     Route::get('/auth/google/redirect', [GoogleController::class, 'redirect'])->name('auth.google.redirect');
     Route::get('/auth/github/redirect', [GitHubController::class, 'redirect'])->name('auth.github.redirect');
+    // Unauthenticated and reachable by anyone, and each call makes the server
+    // talk to the identity provider. Throttled like the other public auth
+    // endpoints so it cannot be used to hammer the provider through us.
+    Route::get('/auth/oidc/redirect', [OidcController::class, 'redirect'])
+        ->middleware('throttle:30,1')
+        ->name('auth.oidc.redirect');
 });
 
 // Callbacks must be reachable by both guests (signup/login) and authenticated
@@ -41,6 +58,9 @@
 // on `Auth::check()` to dispatch to the matching flow.
 Route::get('/auth/google/callback', [GoogleController::class, 'callback'])->name('auth.google.callback');
 Route::get('/auth/github/callback', [GitHubController::class, 'callback'])->name('auth.github.callback');
+Route::get('/auth/oidc/callback', [OidcController::class, 'callback'])
+    ->middleware('throttle:30,1')
+    ->name('auth.oidc.callback');
 
 Route::middleware(['auth'])->group(function () {
     Route::get('/verify-email', EmailVerificationPromptController::class)->name('verification.notice');
diff --git a/tests/Feature/Auth/OidcAuthTest.php b/tests/Feature/Auth/OidcAuthTest.php
new file mode 100644
index 000000000..1bd2eb594
--- /dev/null
+++ b/tests/Feature/Auth/OidcAuthTest.php
@@ -0,0 +1,1508 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Enums\UserWorkspace\Role;
+use App\Http\Controllers\Auth\OidcController;
+use App\Models\Account;
+use App\Models\User;
+use App\Models\Workspace;
+use App\Socialite\OidcProvider;
+use App\Support\Auth\LoginMethods;
+use Firebase\JWT\JWT;
+use GuzzleHttp\Client;
+use GuzzleHttp\Handler\MockHandler;
+use GuzzleHttp\HandlerStack;
+use GuzzleHttp\Middleware;
+use GuzzleHttp\Psr7\Response;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Route;
+use Laravel\Socialite\Facades\Socialite;
+use Laravel\Socialite\Two\InvalidStateException;
+use Laravel\Socialite\Two\User as SocialiteUser;
+use Mockery\MockInterface;
+
+beforeEach(function () {
+    config()->set('trypost.self_hosted', false);
+    config()->set('trypost.oidc_auth_enabled', true);
+    config()->set('trypost.oidc_allowed_groups', '');
+    config()->set('trypost.oidc_auto_join_enabled', false);
+});
+
+/**
+ * Stands in for the real provider so the tests never leave the process.
+ *
+ * @param  array<string, mixed>  $claims  What the provider reports about the user.
+ */
+function fakeOidcDriver(array $claims = [], ?string $idToken = 'id-token-value'): MockInterface
+{
+    $claims = array_merge([
+        'sub' => 'provider-subject-1',
+        'email' => 'member@example.com',
+        'name' => 'Example Member',
+    ], $claims);
+
+    $socialiteUser = (new SocialiteUser)->setRaw($claims)->map([
+        'id' => $claims['sub'],
+        'name' => $claims['name'] ?? null,
+        'email' => $claims['email'] ?? null,
+        'nickname' => $claims['preferred_username'] ?? null,
+    ]);
+
+    $driver = Mockery::mock(OidcProvider::class);
+    $driver->shouldReceive('user')->andReturn($socialiteUser);
+    $driver->shouldReceive('idToken')->andReturn($idToken);
+    $driver->shouldReceive('endSessionEndpoint')->andReturn(null)->byDefault();
+
+    Socialite::shouldReceive('driver')->with('oidc')->andReturn($driver);
+
+    return $driver;
+}
+
+// ---------------------------------------------------------------- wiring ---
+
+test('login page loads whether oidc is enabled or not', function (bool $enabled) {
+    config(['trypost.oidc_auth_enabled' => $enabled]);
+
+    $this->get(route('login'))->assertOk();
+})->with([true, false]);
+
+test('login page shares the oidc flag and the configured display name', function () {
+    config([
+        'trypost.oidc_auth_enabled' => true,
+        'trypost.oidc_display_name' => 'Acme SSO',
+    ]);
+
+    $response = $this->get(route('login'));
+
+    $props = $response->original->getData()['page']['props'];
+
+    expect($props['oidcAuthEnabled'])->toBeTrue()
+        ->and($props['oidcDisplayName'])->toBe('Acme SSO');
+});
+
+test('login page reports oidc as disabled when it is off', function () {
+    config(['trypost.oidc_auth_enabled' => false]);
+
+    $props = $this->get(route('login'))->original->getData()['page']['props'];
+
+    expect($props['oidcAuthEnabled'])->toBeFalse();
+});
+
+test('the redirect route sends the browser to the provider', function () {
+    $driver = Mockery::mock(OidcProvider::class);
+    $driver->shouldReceive('redirect')->andReturn(redirect('https://idp.example.com/authorize'));
+    Socialite::shouldReceive('driver')->with('oidc')->andReturn($driver);
+
+    $this->get(route('auth.oidc.redirect'))
+        ->assertRedirect('https://idp.example.com/authorize');
+});
+
+test('both oidc routes 404 while the feature is disabled', function (string $route) {
+    config(['trypost.oidc_auth_enabled' => false]);
+
+    $this->get(route($route))->assertNotFound();
+})->with(['auth.oidc.redirect', 'auth.oidc.callback']);
+
+test('a failing provider sends the user back to the login page', function () {
+    $driver = Mockery::mock(OidcProvider::class);
+    $driver->shouldReceive('user')->andThrow(new RuntimeException('token rejected'));
+    Socialite::shouldReceive('driver')->with('oidc')->andReturn($driver);
+
+    $this->get(route('auth.oidc.callback'))
+        ->assertRedirect(route('login'))
+        ->assertSessionHasErrors('email');
+
+    $this->assertGuest();
+});
+
+// ----------------------------------------------------------- signing in ---
+
+test('a returning user is matched by the provider subject', function () {
+    $user = User::factory()->create([
+        'oidc_id' => 'provider-subject-1',
+        'email' => 'someone-else@example.com',
+    ]);
+
+    fakeOidcDriver(['sub' => 'provider-subject-1', 'email' => 'member@example.com']);
+
+    $this->get(route('auth.oidc.callback'))->assertRedirect(route('app.home'));
+
+    $this->assertAuthenticatedAs($user);
+});
+
+test('an existing local account is linked by email and keeps the subject', function () {
+    $user = User::factory()->create(['email' => 'member@example.com', 'oidc_id' => null]);
+
+    fakeOidcDriver();
+
+    $this->get(route('auth.oidc.callback'));
+
+    $this->assertAuthenticatedAs($user);
+    expect($user->fresh()->oidc_id)->toBe('provider-subject-1');
+});
+
+test('the id token is kept for logout', function () {
+    User::factory()->create(['email' => 'member@example.com']);
+
+    fakeOidcDriver();
+
+    $this->get(route('auth.oidc.callback'));
+
+    expect(session(OidcController::ID_TOKEN_SESSION_KEY))->toBe('id-token-value');
+});
+
+test('signing in gets a fresh session id', function () {
+    User::factory()->create(['email' => 'member@example.com']);
+
+    fakeOidcDriver();
+
+    $this->startSession();
+    $before = session()->getId();
+
+    $this->get(route('auth.oidc.callback'));
+
+    expect(session()->getId())->not->toBe($before);
+});
+
+// -------------------------------------------------------------- security ---
+
+test('an unverified email cannot claim an existing account', function () {
+    $user = User::factory()->create(['email' => 'member@example.com', 'oidc_id' => null]);
+
+    fakeOidcDriver(['email_verified' => false]);
+
+    $this->get(route('auth.oidc.callback'))
+        ->assertRedirect(route('login'))
+        ->assertSessionHasErrors('email');
+
+    $this->assertGuest();
+    expect($user->fresh()->oidc_id)->toBeNull();
+});
+
+test('a verified email is accepted', function () {
+    $user = User::factory()->create(['email' => 'member@example.com']);
+
+    fakeOidcDriver(['email_verified' => true]);
+
+    $this->get(route('auth.oidc.callback'));
+
+    $this->assertAuthenticatedAs($user);
+});
+
+test('an unverified email still signs in when it collides with nothing', function () {
+    // Providers that simply do not do email verification report false for
+    // everyone. That must not lock them out - it only rules out taking over
+    // an account that already exists.
+    config([
+        'trypost.self_hosted' => false,
+        'trypost.oidc_auto_join_enabled' => false,
+    ]);
+
+    fakeOidcDriver(['email' => 'newcomer@example.com', 'email_verified' => false]);
+
+    $this->get(route('auth.oidc.callback'));
+
+    $this->assertAuthenticated();
+    expect(User::where('email', 'newcomer@example.com')->exists())->toBeTrue();
+});
+
+test('the subject matches even when the email is unverified', function () {
+    $user = User::factory()->create([
+        'oidc_id' => 'provider-subject-1',
+        'email' => 'member@example.com',
+    ]);
+
+    fakeOidcDriver(['email_verified' => false]);
+
+    $this->get(route('auth.oidc.callback'));
+
+    $this->assertAuthenticatedAs($user);
+});
+
+test('a provider that returns no email is refused', function () {
+    fakeOidcDriver(['email' => null]);
+
+    $this->get(route('auth.oidc.callback'))
+        ->assertRedirect(route('login'))
+        ->assertSessionHasErrors('email');
+
+    $this->assertGuest();
+});
+
+test('users outside the allowed groups are turned away', function () {
+    User::factory()->create(['email' => 'member@example.com']);
+    config(['trypost.oidc_allowed_groups' => 'marketing, board']);
+
+    fakeOidcDriver(['groups' => ['support']]);
+
+    $this->get(route('auth.oidc.callback'))
+        ->assertRedirect(route('login'))
+        ->assertSessionHasErrors('email');
+
+    $this->assertGuest();
+});
+
+test('a user in one of the allowed groups gets in', function () {
+    $user = User::factory()->create(['email' => 'member@example.com']);
+    config(['trypost.oidc_allowed_groups' => 'marketing, board']);
+
+    fakeOidcDriver(['groups' => ['support', 'board']]);
+
+    $this->get(route('auth.oidc.callback'));
+
+    $this->assertAuthenticatedAs($user);
+});
+
+test('without an allow list the provider alone decides', function () {
+    $user = User::factory()->create(['email' => 'member@example.com']);
+    config(['trypost.oidc_allowed_groups' => '']);
+
+    fakeOidcDriver(['groups' => []]);
+
+    $this->get(route('auth.oidc.callback'));
+
+    $this->assertAuthenticatedAs($user);
+});
+
+// ------------------------------------------------------------ onboarding ---
+
+test('self-hosted still requires an invite while auto-join is off', function () {
+    config([
+        'trypost.self_hosted' => true,
+        'trypost.oidc_auto_join_enabled' => false,
+    ]);
+
+    fakeOidcDriver();
+
+    $this->get(route('auth.oidc.callback'))->assertNotFound();
+
+    $this->assertGuest();
+});
+
+test('auto-join places a new user on the shared account', function () {
+    config([
+        'trypost.self_hosted' => true,
+        'trypost.oidc_auto_join_enabled' => true,
+        'trypost.oidc_auto_join_role' => Role::Member->value,
+    ]);
+
+    $account = Account::factory()->create(['created_at' => now()->subDay()]);
+    $owner = User::factory()->create(['account_id' => $account->id]);
+    $account->update(['owner_id' => $owner->id]);
+    $workspace = Workspace::factory()->create([
+        'account_id' => $account->id,
+        'user_id' => $owner->id,
+    ]);
+
+    fakeOidcDriver(['email' => 'newcomer@example.com', 'sub' => 'subject-new']);
+
+    $this->get(route('auth.oidc.callback'))->assertRedirect(route('app.home'));
+
+    $user = User::where('email', 'newcomer@example.com')->firstOrFail();
+
+    expect($user->account_id)->toBe($account->id)
+        ->and($user->current_workspace_id)->toBe($workspace->id)
+        ->and($workspace->members()->where('users.id', $user->id)->exists())->toBeTrue();
+});
+
+test('auto-join stays off unless the instance is self-hosted', function () {
+    config([
+        'trypost.self_hosted' => false,
+        'trypost.oidc_auto_join_enabled' => true,
+    ]);
+
+    $account = Account::factory()->create(['created_at' => now()->subDay()]);
+
+    fakeOidcDriver(['email' => 'newcomer@example.com', 'sub' => 'subject-new']);
+
+    $this->get(route('auth.oidc.callback'));
+
+    $user = User::where('email', 'newcomer@example.com')->firstOrFail();
+
+    expect($user->account_id)->not->toBe($account->id);
+});
+
+// ---------------------------------------------------------------- logout ---
+
+test('logging out also ends the session at the provider', function () {
+    $user = User::factory()->create(['oidc_id' => 'provider-subject-1']);
+
+    $driver = Mockery::mock(OidcProvider::class);
+    $driver->shouldReceive('endSessionEndpoint')->andReturn('https://idp.example.com/logout');
+    Socialite::shouldReceive('driver')->with('oidc')->andReturn($driver);
+
+    $response = $this->actingAs($user)
+        ->withSession([OidcController::ID_TOKEN_SESSION_KEY => 'id-token-value'])
+        ->post(route('logout'));
+
+    $response->assertRedirectContains('https://idp.example.com/logout');
+    $response->assertRedirectContains('id_token_hint=id-token-value');
+
+    $this->assertGuest();
+});
+
+test('no post-logout redirect is sent unless one is configured', function () {
+    // Providers reject the whole logout when the URI is not registered with
+    // them character for character, which would leave the user signed in while
+    // believing they are not.
+    config(['trypost.oidc_post_logout_redirect_uri' => null]);
+
+    $user = User::factory()->create(['oidc_id' => 'provider-subject-1']);
+
+    $driver = Mockery::mock(OidcProvider::class);
+    $driver->shouldReceive('endSessionEndpoint')->andReturn('https://idp.example.com/logout');
+    Socialite::shouldReceive('driver')->with('oidc')->andReturn($driver);
+
+    $response = $this->actingAs($user)
+        ->withSession([OidcController::ID_TOKEN_SESSION_KEY => 'id-token-value'])
+        ->post(route('logout'));
+
+    expect($response->headers->get('Location'))->not->toContain('post_logout_redirect_uri');
+});
+
+test('a configured post-logout redirect is passed through untouched', function () {
+    config(['trypost.oidc_post_logout_redirect_uri' => 'https://app.example.com/']);
+
+    $user = User::factory()->create(['oidc_id' => 'provider-subject-1']);
+
+    $driver = Mockery::mock(OidcProvider::class);
+    $driver->shouldReceive('endSessionEndpoint')->andReturn('https://idp.example.com/logout');
+    Socialite::shouldReceive('driver')->with('oidc')->andReturn($driver);
+
+    $response = $this->actingAs($user)
+        ->withSession([OidcController::ID_TOKEN_SESSION_KEY => 'id-token-value'])
+        ->post(route('logout'));
+
+    expect($response->headers->get('Location'))
+        ->toContain('post_logout_redirect_uri='.urlencode('https://app.example.com/'));
+});
+
+test('logout stays local when the user did not use oidc', function () {
+    $user = User::factory()->create();
+
+    $this->actingAs($user)->post(route('logout'))->assertRedirect('/');
+
+    $this->assertGuest();
+});
+
+test('logout stays local when provider logout is switched off', function () {
+    config(['trypost.oidc_logout_enabled' => false]);
+
+    $user = User::factory()->create(['oidc_id' => 'provider-subject-1']);
+
+    $this->actingAs($user)
+        ->withSession([OidcController::ID_TOKEN_SESSION_KEY => 'id-token-value'])
+        ->post(route('logout'))
+        ->assertRedirect('/');
+});
+
+// -------------------------------------------------------------- settings ---
+
+test('the settings page can start an oidc connect', function () {
+    $user = User::factory()->create();
+
+    $driver = Mockery::mock(OidcProvider::class);
+    $driver->shouldReceive('redirect')->andReturn(redirect('https://idp.example.com/authorize'));
+    Socialite::shouldReceive('driver')->with('oidc')->andReturn($driver);
+
+    $this->actingAs($user)
+        ->get(route('app.authentication.connect-provider', 'oidc'))
+        ->assertRedirect('https://idp.example.com/authorize');
+});
+
+test('the settings page lists oidc among the providers', function () {
+    $user = User::factory()->create();
+
+    $props = $this->actingAs($user)
+        ->get(route('app.authentication.edit'))
+        ->original->getData()['page']['props'];
+
+    expect(collect($props['connectedAccounts'])->pluck('provider'))->toContain('oidc');
+});
+
+// ------------------------------------------------------------ key caching ---
+
+/**
+ * Builds a throwaway JWKS plus a Guzzle client that serves it, so the key
+ * handling can be exercised without touching the network.
+ *
+ * @return array{0: Client, 1: array<string, mixed>}
+ */
+function fakeJwksClient(): array
+{
+    $key = openssl_pkey_new([
+        'private_key_bits' => 2048,
+        'private_key_type' => OPENSSL_KEYTYPE_RSA,
+    ]);
+    $details = openssl_pkey_get_details($key);
+
+    $base64url = fn (string $bytes): string => rtrim(strtr(base64_encode($bytes), '+/', '-_'), '=');
+
+    $jwks = ['keys' => [[
+        'kty' => 'RSA',
+        'kid' => 'test-key',
+        'use' => 'sig',
+        'alg' => 'RS256',
+        'n' => $base64url($details['rsa']['n']),
+        'e' => $base64url($details['rsa']['e']),
+    ]]];
+
+    $discovery = [
+        'issuer' => 'https://idp.example.com',
+        'authorization_endpoint' => 'https://idp.example.com/authorize',
+        'token_endpoint' => 'https://idp.example.com/token',
+        'userinfo_endpoint' => 'https://idp.example.com/userinfo',
+        'jwks_uri' => 'https://idp.example.com/jwks',
+    ];
+
+    // Discovery is fetched once and then cached, so every later request in a
+    // test is for the key set.
+    $handler = new MockHandler([
+        new Response(200, [], json_encode($discovery)),
+        new Response(200, [], json_encode($jwks)),
+        new Response(200, [], json_encode($jwks)),
+        new Response(200, [], json_encode($jwks)),
+    ]);
+
+    return [new Client(['handler' => HandlerStack::create($handler)]), $jwks];
+}
+
+test('signing keys survive a cache store that serializes', function () {
+    // The array store keeps objects as they are; a store that serializes would
+    // choke on the OpenSSL key objects inside a parsed key set, so the raw
+    // document has to be what gets cached.
+    config(['cache.default' => 'file']);
+    cache()->clear();
+
+    config([
+        'services.oidc.discovery_url' => 'https://idp.example.com',
+        'services.oidc.client_id' => 'client-id',
+    ]);
+
+    [$client] = fakeJwksClient();
+
+    $provider = new OidcProvider(request(), 'client-id', 'client-secret', 'https://app.example.com/auth/oidc/callback');
+    $provider->setHttpClient($client);
+
+    $method = new ReflectionMethod($provider, 'signingKeys');
+    $method->setAccessible(true);
+
+    $first = $method->invoke($provider);
+
+    // Second call is served from the cache - this is where the old code blew up.
+    $second = $method->invoke($provider);
+
+    expect($first)->toBeArray()->not->toBeEmpty()
+        ->and($second)->toBeArray()->not->toBeEmpty()
+        ->and(array_keys($second))->toBe(array_keys($first));
+});
+
+test('a refresh refetches the key set', function () {
+    config(['cache.default' => 'file']);
+    cache()->clear();
+
+    config(['services.oidc.discovery_url' => 'https://idp.example.com']);
+
+    [$client] = fakeJwksClient();
+
+    $provider = new OidcProvider(request(), 'client-id', 'client-secret', 'https://app.example.com/auth/oidc/callback');
+    $provider->setHttpClient($client);
+
+    $method = new ReflectionMethod($provider, 'signingKeys');
+    $method->setAccessible(true);
+
+    $method->invoke($provider);
+
+    // Forces a second trip to the provider, which the mock handler answers.
+    expect($method->invoke($provider, true))->toBeArray()->not->toBeEmpty();
+});
+
+// ------------------------------------------------- password sign-in toggle ---
+
+test('the password routes stay open by default', function (string $route) {
+    config(['trypost.password_login_enabled' => true]);
+
+    $this->get(route($route))->assertOk();
+})->with(['login', 'password.request']);
+
+test('switching password sign-in off closes its routes', function () {
+    config([
+        'trypost.password_login_enabled' => false,
+        'trypost.oidc_auth_enabled' => true,
+    ]);
+
+    // The login page itself stays - it is where the provider buttons live.
+    $this->get(route('login'))->assertOk();
+
+    $this->post(route('login.store'), [
+        'email' => 'member@example.com',
+        'password' => 'Password123!',
+    ])->assertNotFound();
+
+    $this->get(route('password.request'))->assertNotFound();
+    $this->post(route('password.email'), ['email' => 'member@example.com'])->assertNotFound();
+    $this->get(route('password.reset', ['token' => 'whatever']))->assertNotFound();
+});
+
+test('a correct password is still refused once sign-in is switched off', function () {
+    config([
+        'trypost.password_login_enabled' => false,
+        'trypost.oidc_auth_enabled' => true,
+    ]);
+
+    User::factory()->create([
+        'email' => 'member@example.com',
+        'password' => 'Password123!',
+    ]);
+
+    $this->post(route('login.store'), [
+        'email' => 'member@example.com',
+        'password' => 'Password123!',
+    ])->assertNotFound();
+
+    $this->assertGuest();
+});
+
+test('password sign-in cannot be switched off while it is the only way in', function () {
+    // Otherwise one environment variable locks every user out of the instance.
+    config([
+        'trypost.password_login_enabled' => false,
+        'trypost.oidc_auth_enabled' => false,
+        'trypost.google_auth_enabled' => false,
+        'trypost.github_auth_enabled' => false,
+    ]);
+
+    expect(LoginMethods::passwordEnabled())->toBeTrue();
+
+    $this->get(route('password.request'))->assertOk();
+});
+
+test('the login page says whether the password form belongs there', function (bool $enabled) {
+    config([
+        'trypost.password_login_enabled' => $enabled,
+        'trypost.oidc_auth_enabled' => true,
+    ]);
+
+    $props = $this->get(route('login'))->original->getData()['page']['props'];
+
+    expect($props['passwordLoginEnabled'])->toBe($enabled);
+})->with([true, false]);
+
+test('registering with a password is closed while password sign-in is off', function () {
+    config([
+        'trypost.self_hosted' => false,
+        'trypost.password_login_enabled' => false,
+        'trypost.oidc_auth_enabled' => true,
+    ]);
+
+    // The page stays - it carries the provider buttons.
+    $this->get(route('register'))->assertOk();
+
+    $this->post(route('register.store'), [
+        'name' => 'Test User',
+        'email' => 'nobody@example.com',
+        'password' => 'Password123!',
+    ])->assertNotFound();
+
+    expect(User::where('email', 'nobody@example.com')->exists())->toBeFalse();
+});
+
+test('logging out from the app hands the browser a full page visit', function () {
+    // The app posts logout through Inertia. A plain redirect gets followed by
+    // fetch(), which dies on the provider's CORS preflight - the browser never
+    // navigates and the provider session survives. Inertia answers a 409 with
+    // X-Inertia-Location so the client leaves the page properly.
+    config(['trypost.oidc_post_logout_redirect_uri' => null]);
+
+    $user = User::factory()->create(['oidc_id' => 'provider-subject-1']);
+
+    $driver = Mockery::mock(OidcProvider::class);
+    $driver->shouldReceive('endSessionEndpoint')->andReturn('https://idp.example.com/logout');
+    Socialite::shouldReceive('driver')->with('oidc')->andReturn($driver);
+
+    $response = $this->actingAs($user)
+        ->withSession([OidcController::ID_TOKEN_SESSION_KEY => 'id-token-value'])
+        ->withHeaders(['X-Inertia' => 'true'])
+        ->post(route('logout'));
+
+    $response->assertStatus(409);
+
+    expect($response->headers->get('X-Inertia-Location'))
+        ->toContain('https://idp.example.com/logout')
+        ->toContain('id_token_hint=id-token-value');
+
+    $this->assertGuest();
+});
+
+// ------------------------------------------------- roles from provider groups ---
+
+/**
+ * A workspace with one member, so role changes have something to act on.
+ *
+ * @return array{0: User, 1: Workspace}
+ */
+function memberInWorkspace(string $email, string $role = 'member'): array
+{
+    $account = Account::factory()->create(['created_at' => now()->subDay()]);
+    $owner = User::factory()->create(['account_id' => $account->id]);
+    $account->update(['owner_id' => $owner->id]);
+    $workspace = Workspace::factory()->create([
+        'account_id' => $account->id,
+        'user_id' => $owner->id,
+    ]);
+
+    $user = User::factory()->create([
+        'email' => $email,
+        'account_id' => $account->id,
+        'oidc_id' => 'provider-subject-1',
+    ]);
+    $workspace->members()->attach($user->id, ['role' => $role]);
+
+    return [$user, $workspace];
+}
+
+test('a member of an admin group becomes workspace admin on sign-in', function () {
+    config(['trypost.oidc_admin_groups' => 'board, ops']);
+
+    [$user, $workspace] = memberInWorkspace('member@example.com');
+
+    fakeOidcDriver(['groups' => ['staff', 'ops']]);
+
+    $this->get(route('auth.oidc.callback'));
+
+    expect($workspace->members()->where('users.id', $user->id)->first()->pivot->role)
+        ->toBe('admin');
+});
+
+test('losing the admin group drops the role again on the next sign-in', function () {
+    // This is what makes offboarding work in one place: take someone out of
+    // the group at the provider and their rights go with it.
+    config([
+        'trypost.oidc_admin_groups' => 'board',
+        'trypost.oidc_auto_join_role' => 'member',
+    ]);
+
+    [$user, $workspace] = memberInWorkspace('member@example.com', 'admin');
+
+    fakeOidcDriver(['groups' => ['staff']]);
+
+    $this->get(route('auth.oidc.callback'));
+
+    expect($workspace->members()->where('users.id', $user->id)->first()->pivot->role)
+        ->toBe('member');
+});
+
+test('roles are left alone while no admin group is configured', function () {
+    config(['trypost.oidc_admin_groups' => '']);
+
+    [$user, $workspace] = memberInWorkspace('member@example.com', 'admin');
+
+    fakeOidcDriver(['groups' => []]);
+
+    $this->get(route('auth.oidc.callback'));
+
+    // Without the setting the application stays in charge of roles.
+    expect($workspace->members()->where('users.id', $user->id)->first()->pivot->role)
+        ->toBe('admin');
+});
+
+test('groups arrive whether the provider sends a list or a string', function (mixed $claim) {
+    // Keycloak-style arrays and ADFS-style strings both have to work.
+    config(['trypost.oidc_allowed_groups' => 'board']);
+
+    $user = User::factory()->create(['email' => 'member@example.com']);
+
+    fakeOidcDriver(['groups' => $claim]);
+
+    $this->get(route('auth.oidc.callback'));
+
+    $this->assertAuthenticatedAs($user);
+})->with([
+    [['staff', 'board']],
+    ['staff board'],
+    ['staff,board'],
+]);
+
+test('the first user on an empty instance still gets a workspace', function () {
+    // Auto-join suppresses the personal workspace because it expects a shared
+    // account to join. On a fresh install there is none, and without this the
+    // user lands in an application with nowhere to work.
+    config([
+        'trypost.self_hosted' => true,
+        'trypost.oidc_auto_join_enabled' => true,
+    ]);
+
+    expect(Account::count())->toBe(0);
+
+    fakeOidcDriver(['email' => 'first@example.com', 'sub' => 'subject-first']);
+
+    $this->get(route('auth.oidc.callback'));
+
+    $user = User::where('email', 'first@example.com')->firstOrFail();
+
+    expect($user->workspaces)->toHaveCount(1)
+        ->and($user->account->owner_id)->toBe($user->id);
+});
+
+test('the account owner is left out of the group role sync', function () {
+    // Ownership outranks the workspace role, so demoting the owner would show
+    // "member" in the interface while every permission stays in place.
+    config(['trypost.oidc_admin_groups' => 'board']);
+
+    $account = Account::factory()->create(['created_at' => now()->subDay()]);
+    $owner = User::factory()->create([
+        'account_id' => $account->id,
+        'email' => 'member@example.com',
+        'oidc_id' => 'provider-subject-1',
+    ]);
+    $account->update(['owner_id' => $owner->id]);
+    $workspace = Workspace::factory()->create([
+        'account_id' => $account->id,
+        'user_id' => $owner->id,
+    ]);
+    $workspace->members()->attach($owner->id, ['role' => 'admin']);
+
+    fakeOidcDriver(['groups' => ['staff']]);
+
+    $this->get(route('auth.oidc.callback'));
+
+    expect($workspace->members()->where('users.id', $owner->id)->first()->pivot->role)
+        ->toBe('admin');
+});
+
+// ------------------------------------------ handing the account to the groups ---
+
+test('ownership is released so no one sits outside the group system', function () {
+    config([
+        'trypost.oidc_admin_groups' => 'board',
+        'trypost.oidc_release_ownership' => true,
+    ]);
+
+    $account = Account::factory()->create(['created_at' => now()->subDay()]);
+    $owner = User::factory()->create([
+        'account_id' => $account->id,
+        'email' => 'member@example.com',
+        'oidc_id' => 'provider-subject-1',
+    ]);
+    $account->update(['owner_id' => $owner->id]);
+    $workspace = Workspace::factory()->create([
+        'account_id' => $account->id,
+        'user_id' => $owner->id,
+    ]);
+    $workspace->members()->attach($owner->id, ['role' => 'admin']);
+
+    fakeOidcDriver(['groups' => ['staff']]);
+
+    $this->get(route('auth.oidc.callback'));
+
+    // Ownership gone, and with it the exemption: the role now follows the
+    // groups like everyone else's.
+    expect($account->fresh()->owner_id)->toBeNull()
+        ->and($workspace->members()->where('users.id', $owner->id)->first()->pivot->role)
+        ->toBe('member');
+});
+
+test('ownership is left alone unless releasing it was asked for', function () {
+    config([
+        'trypost.oidc_admin_groups' => 'board',
+        'trypost.oidc_release_ownership' => false,
+    ]);
+
+    $account = Account::factory()->create(['created_at' => now()->subDay()]);
+    $owner = User::factory()->create([
+        'account_id' => $account->id,
+        'email' => 'member@example.com',
+        'oidc_id' => 'provider-subject-1',
+    ]);
+    $account->update(['owner_id' => $owner->id]);
+    Workspace::factory()->create(['account_id' => $account->id, 'user_id' => $owner->id]);
+
+    fakeOidcDriver(['groups' => ['staff']]);
+
+    $this->get(route('auth.oidc.callback'));
+
+    expect($account->fresh()->owner_id)->toBe($owner->id);
+});
+
+// ------------------------------------------------- ID token attack surface ---
+
+/**
+ * A provider wired to a throwaway key pair, plus the pieces needed to forge
+ * tokens against it.
+ *
+ * @return array{provider: OidcProvider, private: string, public: string, kid: string}
+ */
+function oidcProviderUnderTest(): array
+{
+    $key = openssl_pkey_new([
+        'private_key_bits' => 2048,
+        'private_key_type' => OPENSSL_KEYTYPE_RSA,
+    ]);
+    openssl_pkey_export($key, $privatePem);
+    $details = openssl_pkey_get_details($key);
+    $publicPem = $details['key'];
+
+    $b64 = fn (string $bytes): string => rtrim(strtr(base64_encode($bytes), '+/', '-_'), '=');
+    $kid = 'test-key';
+
+    $jwks = ['keys' => [[
+        'kty' => 'RSA', 'kid' => $kid, 'use' => 'sig', 'alg' => 'RS256',
+        'n' => $b64($details['rsa']['n']), 'e' => $b64($details['rsa']['e']),
+    ]]];
+
+    $discovery = [
+        'issuer' => 'https://idp.example.com',
+        'authorization_endpoint' => 'https://idp.example.com/authorize',
+        'token_endpoint' => 'https://idp.example.com/token',
+        'userinfo_endpoint' => 'https://idp.example.com/userinfo',
+        'jwks_uri' => 'https://idp.example.com/jwks',
+    ];
+
+    // Enough responses for repeated discovery/JWKS fetches, including a
+    // refresh attempt after a rejected signature.
+    $queue = [];
+    for ($i = 0; $i < 8; $i++) {
+        $queue[] = new Response(200, [], json_encode($discovery));
+        $queue[] = new Response(200, [], json_encode($jwks));
+    }
+
+    config([
+        'services.oidc.discovery_url' => 'https://idp.example.com',
+        'cache.default' => 'array',
+    ]);
+    cache()->clear();
+
+    // The provider reads the nonce from the request's session. Without binding
+    // it here, validation fails before it ever looks at a signature - and every
+    // attack test would pass for the wrong reason.
+    $request = request();
+    $request->setLaravelSession(app('session.store'));
+
+    $provider = new OidcProvider($request, 'client-id', 'client-secret', 'https://app.example.com/auth/oidc/callback');
+    $provider->setHttpClient(new Client(['handler' => HandlerStack::create(new MockHandler($queue))]));
+
+    return ['provider' => $provider, 'private' => $privatePem, 'public' => $publicPem, 'kid' => $kid];
+}
+
+/**
+ * Runs the provider's ID token validation and says whether it accepted.
+ */
+function idTokenAccepted(OidcProvider $provider, string $token): bool
+{
+    $method = new ReflectionMethod($provider, 'validateIdToken');
+    $method->setAccessible(true);
+
+    try {
+        $method->invoke($provider, $token);
+
+        return true;
+    } catch (Throwable) {
+        return false;
+    }
+}
+
+/**
+ * @param  array<string, mixed>  $overrides
+ * @return array<string, mixed>
+ */
+function idTokenClaims(array $overrides = []): array
+{
+    return array_merge([
+        'iss' => 'https://idp.example.com',
+        'aud' => ['client-id'],
+        'sub' => 'provider-subject-1',
+        'exp' => time() + 300,
+        'iat' => time(),
+        'nonce' => 'the-expected-nonce',
+    ], $overrides);
+}
+
+beforeEach(function () {
+    $this->startSession();
+});
+
+test('a properly signed token is accepted (control)', function () {
+    $ctx = oidcProviderUnderTest();
+    session(['oidc.nonce' => 'the-expected-nonce']);
+
+    $token = JWT::encode(idTokenClaims(), $ctx['private'], 'RS256', $ctx['kid']);
+
+    expect(idTokenAccepted($ctx['provider'], $token))->toBeTrue();
+});
+
+test('an unsigned token is rejected', function () {
+    // The alg=none attack: strip the signature and claim the token needs none.
+    $ctx = oidcProviderUnderTest();
+    session(['oidc.nonce' => 'the-expected-nonce']);
+
+    $b64 = fn (array $d): string => rtrim(strtr(base64_encode(json_encode($d)), '+/', '-_'), '=');
+    $token = $b64(['alg' => 'none', 'typ' => 'JWT', 'kid' => $ctx['kid']]).'.'.$b64(idTokenClaims()).'.';
+
+    expect(idTokenAccepted($ctx['provider'], $token))->toBeFalse();
+});
+
+test('a token signed with the public key as an HMAC secret is rejected', function () {
+    // Algorithm confusion: hand back HS256 and use the provider's own public
+    // key as the shared secret. Fatal wherever the algorithm is taken from the
+    // token instead of the key.
+    $ctx = oidcProviderUnderTest();
+    session(['oidc.nonce' => 'the-expected-nonce']);
+
+    $token = JWT::encode(idTokenClaims(), $ctx['public'], 'HS256', $ctx['kid']);
+
+    expect(idTokenAccepted($ctx['provider'], $token))->toBeFalse();
+});
+
+test('a token signed by a different key is rejected', function () {
+    $ctx = oidcProviderUnderTest();
+    session(['oidc.nonce' => 'the-expected-nonce']);
+
+    $attacker = openssl_pkey_new(['private_key_bits' => 2048, 'private_key_type' => OPENSSL_KEYTYPE_RSA]);
+    openssl_pkey_export($attacker, $attackerPem);
+
+    $token = JWT::encode(idTokenClaims(), $attackerPem, 'RS256', $ctx['kid']);
+
+    expect(idTokenAccepted($ctx['provider'], $token))->toBeFalse();
+});
+
+test('a token for a different audience is rejected', function () {
+    // Token substitution: a token the provider issued for another client.
+    $ctx = oidcProviderUnderTest();
+    session(['oidc.nonce' => 'the-expected-nonce']);
+
+    $token = JWT::encode(idTokenClaims(['aud' => ['some-other-client']]), $ctx['private'], 'RS256', $ctx['kid']);
+
+    expect(idTokenAccepted($ctx['provider'], $token))->toBeFalse();
+});
+
+test('a token from a different issuer is rejected', function () {
+    $ctx = oidcProviderUnderTest();
+    session(['oidc.nonce' => 'the-expected-nonce']);
+
+    $token = JWT::encode(idTokenClaims(['iss' => 'https://evil.example.com']), $ctx['private'], 'RS256', $ctx['kid']);
+
+    expect(idTokenAccepted($ctx['provider'], $token))->toBeFalse();
+});
+
+test('an expired token is rejected', function () {
+    $ctx = oidcProviderUnderTest();
+    session(['oidc.nonce' => 'the-expected-nonce']);
+
+    $token = JWT::encode(idTokenClaims(['exp' => time() - 3600]), $ctx['private'], 'RS256', $ctx['kid']);
+
+    expect(idTokenAccepted($ctx['provider'], $token))->toBeFalse();
+});
+
+test('a token replayed from another login is rejected', function () {
+    // Right signature, right audience, wrong login: the nonce ties a token to
+    // the one authorization request that asked for it.
+    $ctx = oidcProviderUnderTest();
+    session(['oidc.nonce' => 'the-expected-nonce']);
+
+    $token = JWT::encode(idTokenClaims(['nonce' => 'a-nonce-from-another-login']), $ctx['private'], 'RS256', $ctx['kid']);
+
+    expect(idTokenAccepted($ctx['provider'], $token))->toBeFalse();
+});
+
+test('a token without a nonce is rejected', function () {
+    $ctx = oidcProviderUnderTest();
+    session(['oidc.nonce' => 'the-expected-nonce']);
+
+    $claims = idTokenClaims();
+    unset($claims['nonce']);
+    $token = JWT::encode($claims, $ctx['private'], 'RS256', $ctx['kid']);
+
+    expect(idTokenAccepted($ctx['provider'], $token))->toBeFalse();
+});
+
+test('the nonce is consumed, so the same token cannot be used twice', function () {
+    $ctx = oidcProviderUnderTest();
+    session(['oidc.nonce' => 'the-expected-nonce']);
+
+    $token = JWT::encode(idTokenClaims(), $ctx['private'], 'RS256', $ctx['kid']);
+
+    expect(idTokenAccepted($ctx['provider'], $token))->toBeTrue()
+        ->and(idTokenAccepted($ctx['provider'], $token))->toBeFalse();
+});
+
+// --------------------------------------------- the authorization round-trip ---
+
+/**
+ * Drives the real provider (no mocked driver), so state and PKCE are actually
+ * exercised instead of being skipped.
+ *
+ * @return array{provider: OidcProvider, private: string, kid: string}
+ */
+function oidcProviderForRoundTrip(Request $request): array
+{
+    $key = openssl_pkey_new(['private_key_bits' => 2048, 'private_key_type' => OPENSSL_KEYTYPE_RSA]);
+    openssl_pkey_export($key, $privatePem);
+    $details = openssl_pkey_get_details($key);
+    $b64 = fn (string $b): string => rtrim(strtr(base64_encode($b), '+/', '-_'), '=');
+    $kid = 'test-key';
+
+    $discovery = [
+        'issuer' => 'https://idp.example.com',
+        'authorization_endpoint' => 'https://idp.example.com/authorize',
+        'token_endpoint' => 'https://idp.example.com/token',
+        'userinfo_endpoint' => 'https://idp.example.com/userinfo',
+        'jwks_uri' => 'https://idp.example.com/jwks',
+    ];
+    $jwks = ['keys' => [[
+        'kty' => 'RSA', 'kid' => $kid, 'use' => 'sig', 'alg' => 'RS256',
+        'n' => $b64($details['rsa']['n']), 'e' => $b64($details['rsa']['e']),
+    ]]];
+
+    $queue = [];
+    for ($i = 0; $i < 6; $i++) {
+        $queue[] = new Response(200, [], json_encode($discovery));
+        $queue[] = new Response(200, [], json_encode($jwks));
+    }
+
+    config(['services.oidc.discovery_url' => 'https://idp.example.com', 'cache.default' => 'array']);
+    cache()->clear();
+
+    $provider = new OidcProvider($request, 'client-id', 'client-secret', 'https://app.example.com/auth/oidc/callback');
+    $provider->setHttpClient(new Client(['handler' => HandlerStack::create(new MockHandler($queue))]));
+
+    return ['provider' => $provider, 'private' => $privatePem, 'kid' => $kid];
+}
+
+test('a callback whose state does not match the session is refused', function () {
+    // Without this, an attacker can start a login with their own account and
+    // hand the victim the callback URL, landing the victim in the attacker's
+    // session. The mocked driver used elsewhere skips this check entirely.
+    $this->startSession();
+    session(['state' => 'the-state-we-issued']);
+
+    $request = Request::create('/auth/oidc/callback', 'GET', [
+        'code' => 'whatever',
+        'state' => 'a-state-from-somewhere-else',
+    ]);
+    $request->setLaravelSession(app('session.store'));
+
+    $ctx = oidcProviderForRoundTrip($request);
+
+    expect(fn () => $ctx['provider']->user())
+        ->toThrow(InvalidStateException::class);
+});
+
+test('a callback with no state at all is refused', function () {
+    $this->startSession();
+    session(['state' => 'the-state-we-issued']);
+
+    $request = Request::create('/auth/oidc/callback', 'GET', ['code' => 'whatever']);
+    $request->setLaravelSession(app('session.store'));
+
+    $ctx = oidcProviderForRoundTrip($request);
+
+    expect(fn () => $ctx['provider']->user())
+        ->toThrow(InvalidStateException::class);
+});
+
+test('the authorization request carries PKCE, a nonce and a state', function () {
+    $this->startSession();
+
+    $request = Request::create('/auth/oidc/redirect', 'GET');
+    $request->setLaravelSession(app('session.store'));
+
+    $ctx = oidcProviderForRoundTrip($request);
+
+    $target = $ctx['provider']->redirect()->getTargetUrl();
+    parse_str((string) parse_url($target, PHP_URL_QUERY), $query);
+
+    expect($query['code_challenge_method'] ?? null)->toBe('S256')
+        ->and($query['code_challenge'] ?? null)->not->toBeEmpty()
+        ->and($query['state'] ?? null)->not->toBeEmpty()
+        ->and($query['nonce'] ?? null)->not->toBeEmpty()
+        ->and($query['scope'] ?? '')->toContain('openid');
+
+    // Both have to be held server-side, or neither proves anything.
+    expect(session('state'))->toBe($query['state'])
+        ->and(session('oidc.nonce'))->toBe($query['nonce'])
+        ->and(session('code_verifier'))->not->toBeEmpty();
+
+    // The challenge must actually derive from the stored verifier.
+    $expected = rtrim(strtr(base64_encode(hash('sha256', (string) session('code_verifier'), true)), '+/', '-_'), '=');
+    expect($query['code_challenge'])->toBe($expected);
+});
+
+test('a failed sign-in never writes credentials to the log', function () {
+    // The callback logs why it failed, which is the only way to debug a
+    // misconfigured provider. It must not turn the log into a place where
+    // client secrets or tokens end up.
+    config([
+        'trypost.oidc_auth_enabled' => true,
+        'services.oidc.client_secret' => 'super-secret-client-value',
+    ]);
+
+    $captured = [];
+    Log::listen(function ($message) use (&$captured) {
+        $captured[] = $message->message.' '.json_encode($message->context);
+    });
+
+    $driver = Mockery::mock(OidcProvider::class);
+    $driver->shouldReceive('user')->andThrow(new RuntimeException(
+        'token endpoint said: {"error":"invalid_client"}'
+    ));
+    Socialite::shouldReceive('driver')->with('oidc')->andReturn($driver);
+
+    $this->get(route('auth.oidc.callback'))->assertRedirect(route('login'));
+
+    $log = implode("\n", $captured);
+
+    expect($log)->not->toBeEmpty()
+        ->and($log)->not->toContain('super-secret-client-value')
+        ->and($log)->not->toContain('client_secret')
+        ->and($log)->not->toContain('id_token')
+        ->and($log)->not->toContain('access_token');
+});
+
+test('the oidc endpoints are throttled', function (string $route) {
+    // Both are public and make the server call out to the provider, so they
+    // must not be free to hammer.
+    $middleware = collect(Route::getRoutes())
+        ->first(fn ($r) => $r->getName() === $route)
+        ?->gatherMiddleware() ?? [];
+
+    expect($middleware)->toContain('throttle:30,1');
+})->with(['auth.oidc.redirect', 'auth.oidc.callback']);
+
+test('every string the login page can show is translated', function (string $locale) {
+    // A missing key renders as the raw key name in the interface, which is how
+    // "Enter your email and password below" stayed on a page that has no
+    // password field.
+    app()->setLocale($locale);
+
+    foreach ([
+        'auth.login.description',
+        'auth.login.description_without_password',
+        'auth.oidc_login',
+        'auth.oidc_signup',
+        'auth.oidc_failed',
+        'auth.oidc_group_denied',
+        'auth.oidc_email_missing',
+        'auth.oidc_email_unverified',
+    ] as $key) {
+        expect(__($key))->not->toBe($key, "missing translation: {$key} ({$locale})");
+    }
+})->with(['en', 'de']);
+
+// ------------------------------------------------- discovery & userinfo ---
+
+/**
+ * A provider whose HTTP answers the test dictates, so the paths around a
+ * misconfigured or thin identity provider can be exercised directly.
+ *
+ * @param  array<int, Response>  $responses
+ */
+function oidcProviderAnswering(array $responses, string $discoveryUrl = 'https://idp.example.com'): array
+{
+    config([
+        'services.oidc.discovery_url' => $discoveryUrl,
+        'cache.default' => 'array',
+    ]);
+    cache()->clear();
+
+    $history = [];
+    $stack = HandlerStack::create(new MockHandler($responses));
+    $stack->push(Middleware::history($history));
+
+    $request = request();
+    $request->setLaravelSession(app('session.store'));
+
+    $provider = new OidcProvider($request, 'client-id', 'client-secret', 'https://app.example.com/auth/oidc/callback');
+    $provider->setHttpClient(new Client(['handler' => $stack]));
+
+    return ['provider' => $provider, 'history' => &$history];
+}
+
+/** Calls a protected method on the provider. */
+function callOnProvider(OidcProvider $provider, string $method, mixed ...$arguments): mixed
+{
+    $reflection = new ReflectionMethod($provider, $method);
+    $reflection->setAccessible(true);
+
+    return $reflection->invoke($provider, ...$arguments);
+}
+
+function fullDiscovery(array $overrides = []): array
+{
+    return array_merge([
+        'issuer' => 'https://idp.example.com',
+        'authorization_endpoint' => 'https://idp.example.com/authorize',
+        'token_endpoint' => 'https://idp.example.com/token',
+        'userinfo_endpoint' => 'https://idp.example.com/userinfo',
+        'jwks_uri' => 'https://idp.example.com/jwks',
+    ], $overrides);
+}
+
+test('a discovery document without the endpoints we need is refused', function (array $document) {
+    // Half a document is worse than none: the login would fail later, on a
+    // page that cannot say why.
+    $ctx = oidcProviderAnswering([new Response(200, [], json_encode($document))]);
+
+    expect(fn () => $ctx['provider']->discovery())->toThrow(RuntimeException::class);
+})->with([
+    'nothing at all' => [[]],
+    'no authorization endpoint' => [['token_endpoint' => 'https://idp.example.com/token']],
+    'no token endpoint' => [['authorization_endpoint' => 'https://idp.example.com/authorize']],
+]);
+
+test('a discovery response that is not a document at all is refused', function () {
+    $ctx = oidcProviderAnswering([new Response(200, [], '<html>login here</html>')]);
+
+    expect(fn () => $ctx['provider']->discovery())->toThrow(RuntimeException::class);
+});
+
+test('the discovery document is fetched once and then reused', function () {
+    // Every sign-in would otherwise pay for the round-trip, and a provider
+    // under load would feel it.
+    // Three answers are queued on purpose: without the cache the extra calls
+    // would be served rather than blowing up, so the count is what fails.
+    $ctx = oidcProviderAnswering(array_fill(0, 3, new Response(200, [], json_encode(fullDiscovery()))));
+
+    $ctx['provider']->discovery();
+    $ctx['provider']->discovery();
+    $ctx['provider']->discovery();
+
+    expect($ctx['history'])->toHaveCount(1);
+});
+
+test('a bare issuer URL is expanded to the well-known path', function () {
+    // Pasting the issuer is the easier thing to get right, so it has to work.
+    $ctx = oidcProviderAnswering(
+        [new Response(200, [], json_encode(fullDiscovery()))],
+        'https://idp.example.com/realms/club',
+    );
+
+    $ctx['provider']->discovery();
+
+    expect((string) $ctx['history'][0]['request']->getUri())
+        ->toBe('https://idp.example.com/realms/club/.well-known/openid-configuration');
+});
+
+test('a discovery URL that already points at the document is left alone', function () {
+    $ctx = oidcProviderAnswering(
+        [new Response(200, [], json_encode(fullDiscovery()))],
+        'https://idp.example.com/.well-known/openid-configuration',
+    );
+
+    $ctx['provider']->discovery();
+
+    expect((string) $ctx['history'][0]['request']->getUri())
+        ->toBe('https://idp.example.com/.well-known/openid-configuration');
+});
+
+test('an unconfigured discovery URL fails instead of guessing', function () {
+    $ctx = oidcProviderAnswering([]);
+    config(['services.oidc.discovery_url' => '']);
+
+    expect(fn () => $ctx['provider']->discovery())->toThrow(RuntimeException::class);
+});
+
+test('a provider that publishes no logout endpoint reports none', function () {
+    // Not every provider offers RP-initiated logout; that is not an error.
+    $ctx = oidcProviderAnswering([
+        new Response(200, [], json_encode(fullDiscovery(['end_session_endpoint' => null]))),
+    ]);
+
+    expect($ctx['provider']->endSessionEndpoint())->toBeNull();
+});
+
+test('an unreachable provider does not stop anyone logging out', function () {
+    // Logout has to work even when the provider is down, or a user is stuck
+    // signed in with no way to end the session.
+    $ctx = oidcProviderAnswering([new Response(500, [], 'gateway down')]);
+
+    expect($ctx['provider']->endSessionEndpoint())->toBeNull();
+});
+
+test('a provider without a userinfo endpoint is refused', function () {
+    $ctx = oidcProviderAnswering([
+        new Response(200, [], json_encode(fullDiscovery(['userinfo_endpoint' => null]))),
+    ]);
+
+    expect(fn () => callOnProvider($ctx['provider'], 'getUserByToken', 'access-token'))
+        ->toThrow(RuntimeException::class);
+});
+
+test('claims the userinfo endpoint leaves out are filled in from the ID token', function () {
+    // Providers commonly put `groups` in the ID token only. Losing it here
+    // would silently strip everyone of their group-derived role.
+    $ctx = oidcProviderAnswering([
+        new Response(200, [], json_encode(fullDiscovery())),
+        new Response(200, [], json_encode(['sub' => 'provider-subject-1', 'email' => 'member@example.com'])),
+    ]);
+
+    $reflection = new ReflectionProperty($ctx['provider'], 'idTokenClaims');
+    $reflection->setAccessible(true);
+    $reflection->setValue($ctx['provider'], ['groups' => ['board'], 'sub' => 'provider-subject-1']);
+
+    $claims = callOnProvider($ctx['provider'], 'getUserByToken', 'access-token');
+
+    expect($claims['groups'])->toBe(['board'])
+        ->and($claims['email'])->toBe('member@example.com');
+});
+
+test('userinfo wins over the ID token where both carry a claim', function () {
+    // The precedence is worth pinning down: userinfo is the fresher answer.
+    $ctx = oidcProviderAnswering([
+        new Response(200, [], json_encode(fullDiscovery())),
+        new Response(200, [], json_encode(['sub' => 'provider-subject-1', 'email' => 'new@example.com'])),
+    ]);
+
+    $reflection = new ReflectionProperty($ctx['provider'], 'idTokenClaims');
+    $reflection->setAccessible(true);
+    $reflection->setValue($ctx['provider'], ['email' => 'stale@example.com', 'sub' => 'provider-subject-1']);
+
+    expect(callOnProvider($ctx['provider'], 'getUserByToken', 'access-token')['email'])
+        ->toBe('new@example.com');
+});
+
+test('a provider that returns no subject is refused', function () {
+    // Without a subject there is nothing stable to tie the account to.
+    $ctx = oidcProviderAnswering([]);
+
+    expect(fn () => callOnProvider($ctx['provider'], 'mapUserToObject', ['email' => 'member@example.com']))
+        ->toThrow(RuntimeException::class);
+});
+
+test('the display name falls back through what the provider did send', function (array $claims, string $expected) {
+    $ctx = oidcProviderAnswering([]);
+
+    $user = callOnProvider($ctx['provider'], 'mapUserToObject', $claims + ['sub' => 'provider-subject-1']);
+
+    expect($user->getName())->toBe($expected);
+})->with([
+    'a full name' => [['name' => 'Example Member'], 'Example Member'],
+    'given and family name' => [['given_name' => 'Example', 'family_name' => 'Member'], 'Example Member'],
+    'only a username' => [['preferred_username' => 'member'], 'member'],
+]);
+
+test('a response with no ID token at all is refused', function () {
+    $ctx = oidcProviderUnderTest();
+
+    expect(idTokenAccepted($ctx['provider'], ''))->toBeFalse();
+});
+
+// ----------------------------------------- linking a provider to oneself ---
+
+test('connecting stores the subject on the signed-in account', function () {
+    $user = User::factory()->create(['oidc_id' => null]);
+
+    fakeOidcDriver(['sub' => 'provider-subject-9']);
+
+    $this->actingAs($user)->get(route('auth.oidc.callback'));
+
+    expect($user->fresh()->oidc_id)->toBe('provider-subject-9');
+});
+
+test('a subject already linked to someone else cannot be taken over', function () {
+    // Otherwise anyone who can sign in at the provider could attach that
+    // identity to a second local account and reach it from both.
+    $owner = User::factory()->create(['oidc_id' => 'provider-subject-9']);
+    $other = User::factory()->create(['oidc_id' => null]);
+
+    fakeOidcDriver(['sub' => 'provider-subject-9']);
+
+    $this->actingAs($other)
+        ->get(route('auth.oidc.callback'))
+        ->assertSessionHas('flash.error');
+
+    expect($other->fresh()->oidc_id)->toBeNull()
+        ->and($owner->fresh()->oidc_id)->toBe('provider-subject-9');
+});
+
+test('connecting the same subject again changes nothing', function () {
+    $user = User::factory()->create(['oidc_id' => 'provider-subject-9']);
+
+    fakeOidcDriver(['sub' => 'provider-subject-9']);
+
+    $this->actingAs($user)
+        ->get(route('auth.oidc.callback'))
+        ->assertSessionHas('flash.success');
+
+    expect($user->fresh()->oidc_id)->toBe('provider-subject-9');
+});
+
+// ------------------------------------------------------- token exchange ---
+
+/**
+ * Key material plus the JWKS document that publishes it.
+ *
+ * @return array{private: string, kid: string, jwks: array<string, mixed>}
+ */
+function oidcTestKeys(): array
+{
+    $key = openssl_pkey_new([
+        'private_key_bits' => 2048,
+        'private_key_type' => OPENSSL_KEYTYPE_RSA,
+    ]);
+    openssl_pkey_export($key, $privatePem);
+    $details = openssl_pkey_get_details($key);
+
+    $b64 = fn (string $bytes): string => rtrim(strtr(base64_encode($bytes), '+/', '-_'), '=');
+    $kid = 'test-key';
+
+    return [
+        'private' => $privatePem,
+        'kid' => $kid,
+        'jwks' => ['keys' => [[
+            'kty' => 'RSA', 'kid' => $kid, 'use' => 'sig', 'alg' => 'RS256',
+            'n' => $b64($details['rsa']['n']), 'e' => $b64($details['rsa']['e']),
+        ]]],
+    ];
+}
+
+test('the token exchange verifies the ID token it was handed', function () {
+    // The whole chain in one go: discovery, the code-for-token call, and the
+    // signature check against the published keys.
+    $keys = oidcTestKeys();
+    $token = JWT::encode(idTokenClaims(), $keys['private'], 'RS256', $keys['kid']);
+
+    $ctx = oidcProviderAnswering([
+        new Response(200, [], json_encode(fullDiscovery())),
+        new Response(200, [], json_encode(['access_token' => 'at', 'id_token' => $token])),
+        new Response(200, [], json_encode($keys['jwks'])),
+    ]);
+    session(['oidc.nonce' => 'the-expected-nonce']);
+
+    $response = $ctx['provider']->getAccessTokenResponse('the-code');
+
+    expect($response['access_token'])->toBe('at')
+        ->and($ctx['provider']->idToken())->toBe($token);
+});
+
+test('a token response with no ID token is refused', function () {
+    // An OIDC provider that answers like a plain OAuth2 one proves nothing
+    // about who signed in.
+    $ctx = oidcProviderAnswering([
+        new Response(200, [], json_encode(fullDiscovery())),
+        new Response(200, [], json_encode(['access_token' => 'at'])),
+    ]);
+    session(['oidc.nonce' => 'the-expected-nonce']);
+
+    expect(fn () => $ctx['provider']->getAccessTokenResponse('the-code'))
+        ->toThrow(RuntimeException::class);
+});
+
+test('a token response carrying a forged ID token is refused', function () {
+    // Signed with a key the provider never published.
+    $published = oidcTestKeys();
+    $attacker = oidcTestKeys();
+    $token = JWT::encode(idTokenClaims(), $attacker['private'], 'RS256', $published['kid']);
+
+    $ctx = oidcProviderAnswering([
+        new Response(200, [], json_encode(fullDiscovery())),
+        new Response(200, [], json_encode(['access_token' => 'at', 'id_token' => $token])),
+        new Response(200, [], json_encode($published['jwks'])),
+        new Response(200, [], json_encode($published['jwks'])),
+    ]);
+    session(['oidc.nonce' => 'the-expected-nonce']);
+
+    expect(fn () => $ctx['provider']->getAccessTokenResponse('the-code'))
+        ->toThrow(RuntimeException::class, 'The ID token could not be verified');
+});