diff --git a/www/ap-auth-openidc/DESCR b/www/ap-auth-openidc/DESCR
new file mode 100644
index 000000000000..27d811dcfe9a
--- /dev/null
+++ b/www/ap-auth-openidc/DESCR
@@ -0,0 +1,3 @@
+mod_auth_openidc is an authentication/authorization module for the
+Apache 2.x HTTP server that functions as an OpenID Connect Relying
+Party, authenticating users against an OpenID Connect Provider.
diff --git a/www/ap-auth-openidc/Makefile b/www/ap-auth-openidc/Makefile
new file mode 100644
index 000000000000..c53ca1d37495
--- /dev/null
+++ b/www/ap-auth-openidc/Makefile
@@ -0,0 +1,30 @@
+# $NetBSD: Makefile,v 1.1 2021/07/22 15:58:49 jperkin Exp $
+
+GITHUB_PROJECT=	mod_auth_openidc
+DISTNAME=	${GITHUB_PROJECT}-2.4.8.4
+PKGNAME=	${DISTNAME:S/mod/${APACHE_PKG_PREFIX}/:S/_/-/g}
+CATEGORIES=	www
+MASTER_SITES=	${MASTER_SITE_GITHUB:=zmartzone/}
+GITHUB_RELEASE=	v${PKGVERSION_NOREV}
+
+HOMEPAGE=	https://github.com/zmartzone/mod_auth_openidc
+COMMENT=	OpenID Connect Relying Party implementation for Apache HTTP Server 2.x
+LICENSE=	apache-2.0
+
+GNU_CONFIGURE=		yes
+CONFIGURE_ARGS+=	--with-apxs2=${APXS}
+USE_TOOLS+=		gmake
+USE_TOOLS+=		pkg-config
+
+APACHE_MODULE=		yes
+
+INSTALLATION_DIRS+=	lib/httpd
+
+do-install:
+	${INSTALL_LIB} ${WRKSRC}/src/.libs/mod_auth_openidc.so ${DESTDIR}${PREFIX}/lib/httpd
+
+.include "../../devel/pcre/buildlink3.mk"
+.include "../../mk/apache.mk"
+.include "../../textproc/cjose/buildlink3.mk"
+.include "../../www/curl/buildlink3.mk"
+.include "../../mk/bsd.pkg.mk"
diff --git a/www/ap-auth-openidc/PLIST b/www/ap-auth-openidc/PLIST
new file mode 100644
index 000000000000..2b428f6b21b3
--- /dev/null
+++ b/www/ap-auth-openidc/PLIST
@@ -0,0 +1,2 @@
+@comment $NetBSD: PLIST,v 1.1 2021/07/22 15:58:49 jperkin Exp $
+lib/httpd/mod_auth_openidc.so
diff --git a/www/ap-auth-openidc/distinfo b/www/ap-auth-openidc/distinfo
new file mode 100644
index 000000000000..2eeb6872ea22
--- /dev/null
+++ b/www/ap-auth-openidc/distinfo
@@ -0,0 +1,7 @@
+$NetBSD: distinfo,v 1.1 2021/07/22 15:58:49 jperkin Exp $
+
+SHA1 (mod_auth_openidc-2.4.8.4.tar.gz) = 3e45db5c6b02076fc7979797968a6306c9653078
+RMD160 (mod_auth_openidc-2.4.8.4.tar.gz) = 85aa8b086b8b720a04b9e16a631a84546d8746fb
+SHA512 (mod_auth_openidc-2.4.8.4.tar.gz) = fcba4a26944d4173b4ab33f9171441046ad106b707fc6e296a9abddf582bc97573c7aab2a2d74317be05a10156b87e24f82bd665c2961aa2d896f3ab317f2834
+Size (mod_auth_openidc-2.4.8.4.tar.gz) = 287237 bytes
+SHA1 (patch-configure) = 98afe179c3f8f6126f5a8c70d36337953573eb26
diff --git a/www/ap-auth-openidc/patches/patch-configure b/www/ap-auth-openidc/patches/patch-configure
new file mode 100644
index 000000000000..9f3eeecd2161
--- /dev/null
+++ b/www/ap-auth-openidc/patches/patch-configure
@@ -0,0 +1,15 @@
+$NetBSD: patch-configure,v 1.1 2021/07/22 15:58:49 jperkin Exp $
+
+Shell portability.
+
+--- configure.orig	2021-06-02 06:20:17.000000000 +0000
++++ configure
+@@ -4181,7 +4181,7 @@ fi
+ 
+ case "$with_hiredis" in #(
+   yes) :
+-    if test "$HIREDIS_LIBS" == ""; then
++    if test "$HIREDIS_LIBS" = ""; then
+ pkg_failed=no
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for hiredis" >&5
+ printf %s "checking for hiredis... " >&6; }