Google Workspace Setup for Open WebUI

The goal is to let organizations control admin and user access in Open WebUI based on their Google Group memberships — for example:

• [email protected] → Admin access
• [email protected] → Standard user access

Before You Begin

You’ll need:

• Access to your organization’s Google Admin Console (not Google Cloud Console)
• At least one Google Group created for Open WebUI admins (e.g. [email protected])
• The Keycloak ACS URL and Entity ID provided by Arthur (see below)

Step 1 — Open the Google Admin Console

1. Go to https://admin.google.com
2. Sign in with an account that has Super Admin privileges.

Step 2 — Create a Custom SAML App

1. In the left sidebar: Apps → Web and mobile apps → Add app → Add custom SAML app
2. Enter an app name such as “Open WebUI (Arthur)”
3. (Optional) Upload your company or Arthur logo for easy identification.
4. Click Continue

Step 3 — Download Google’s IdP Information

Google will now display:

• SSO URL
• Entity ID
• Certificate (X.509)

📤 Send these three values to your Arthur contact or Keycloak administrator.

They will configure them inside Keycloak to establish trust between Google and Keycloak.

Then click Continue.

Step 4 — Enter Arthur’s Keycloak Information

On the next screen, fill in the service provider details exactly as follows:

Then click Continue.

Step 5 — Add Attribute Mappings

This section defines what user information is sent to Keycloak.

Add the following mappings:

Tip: The Groups attribute is what enables role mapping (e.g. admin/user) inside Keycloak.

Click Continue.

⚙️ Step 6 — Add Group Memberships (for Admin/User roles)

You’ll now see a section titled “Group membership (optional)”.

This is where you define which Google Groups get sent to Keycloak.

1. Under Google groups, click the field and add:

• [email protected]
• [email protected] (Or whatever group emails your organization will use.)

2. Under App attribute, type: Groups

Example configuration:

3. Click Finish

Step 7 — Assign Access

By default, your new SAML app is off for everyone.

To allow users to log in:

1. Go to the app you just created under Apps → Web and mobile apps
2. Click the new Open WebUI (Arthur) app
3. Under User Access, set: ON for everyone or restrict to specific organizational units (OUs) if needed.

Step 8 — Send Information to Arthur (Keycloak Admin)

Provide your Arthur contact or Keycloak admin with the following information:

Arthur’s team will configure these inside Keycloak to complete the connection.

How Keycloak Uses This Information

Arthur’s Keycloak admin will:

1. Create two realm roles: admin and user
2. Add mappers in Keycloak that translate Google Groups → roles:

• Groups = [email protected] → admin
• Groups = [email protected] → user

3. Test logins from both groups to confirm correct role assignment.

When a user logs into Open WebUI via Keycloak:

• If they belong to the admin group, they’ll get full admin privileges.
• If they belong to the user group, they’ll get standard user access.

Summary

Example Group Design (Recommended)

These groups can be managed directly by your organization’s IT team to control Open WebUI permissions dynamically — no need for Arthur to change anything.

End Result

That’s it! Your organization is now configured to use Google SAML SSO for Open WebUI via Arthur’s Keycloak. All role assignments are fully automated through your existing Google Groups.