Google Workspace Setup for OpenWebUI

The goal is to let organizations control admin and user access in OpenWebUI based on their Google Group memberships — for example:

• [email protected] → Admin access
• [email protected] → Standard user access

---

Before You Begin

You’ll need:

• Access to your organization’s Google Admin Console (not Google Cloud Console)
• At least one Google Group created for Open WebUI admins (e.g. [email protected])
• The Keycloak ACS URL and Entity ID provided by Arthur (see below)

---

Step 1 — Open the Google Admin Console

1. Go to https://admin.google.com
2. Sign in with an account that has Super Admin privileges.

---

Step 2 — Create a Custom SAML App

1. In the left sidebar:
   Apps → Web and mobile apps → Add app → Add custom SAML app
2. Enter an app name such as “Open WebUI (Arthur)”
3. (Optional) Upload your company or Arthur logo for easy identification.
4. Click Continue

---

Step 3 — Download Google’s IdP Information

Google will now display:

• SSO URL
• Entity ID
• Certificate (X.509)

📤 Send these three values to your Arthur contact or Keycloak administrator.

They will configure them inside Keycloak to establish trust between Google and Keycloak.

Then click Continue.

---

Step 4 — Enter Arthur’s Keycloak Information

On the next screen, fill in the service provider details exactly as follows:

Then click Continue.

---

Step 5 — Add Attribute Mappings

This section defines what user information is sent to Keycloak.

Add the following mappings:

Click Continue.

---

⚙️ Step 6 — Add Group Memberships (for Admin/User roles)

You’ll now see a section titled “Group membership (optional)”.

This is where you define which Google Groups get sent to Keycloak.

1. Under Google groups, click the field and add:

• [email protected]
• [email protected]
  (Or whatever group emails your organization will use.)

2. Under App attribute, type: Groups

Example configuration:

3. Click Finish

---

Step 7 — Assign Access

By default, your new SAML app is off for everyone.

To allow users to log in:

1. Go to the app you just created under
   Apps → Web and mobile apps
2. Click the new Open WebUI (Arthur) app
3. Under User Access, set: ON for everyone or restrict to specific organizational units (OUs) if needed.

Step 8 — Send Information to Arthur (Keycloak Admin)

Provide your Arthur contact or Keycloak admin with the following information:

Arthur’s team will configure these inside Keycloak to complete the connection.

---

How Keycloak Uses This Information

Arthur’s Keycloak admin will:

1. Create two realm roles: admin and user
2. Add mappers in Keycloak that translate Google Groups → roles:

• Groups = [email protected] → admin
• Groups = [email protected] → user

3. Test logins from both groups to confirm correct role assignment.

When a user logs into Open WebUI via Keycloak:

• If they belong to the admin group, they’ll get full admin privileges.
• If they belong to the user group, they’ll get standard user access.

---

Summary

---

Example Group Design (Recommended)

These groups can be managed directly by your organization’s IT team to control Open WebUI permissions dynamically — no need for Arthur to change anything.

---

End Result

---

That’s it!
Your organization is now configured to use Google SAML SSO for Open WebUI via Arthur’s Keycloak.
All role assignments are fully automated through your existing Google Groups.