--- updatedAt: 2025-10-23T17:05:31.000Z agentTools: projectIndex: https://docs.arthur.ai/llms.txt --- # Google Workspace Setup for OpenWebUI This guide explains how to configure **Google Workspace** as the **Identity Provider (IdP)** for **Arthur’s Keycloak**, which brokers authentication into **Open WebUI**. The goal is to let organizations control **admin** and **user** access in OpenWebUI based on their **Google Group memberships** — for example: * `openwebui-admins@yourcompany.com` → Admin access * `openwebui-users@yourcompany.com` → Standard user access *** ## Before You Begin You’ll need: * Access to your organization’s **Google Admin Console** (not Google Cloud Console) * At least one **Google Group** created for Open WebUI admins (e.g. `openwebui-admins@yourcompany.com`) * The **Keycloak ACS URL** and **Entity ID** provided by Arthur (see below) *** ## Step 1 — Open the Google Admin Console 1. Go to **** 2. Sign in with an account that has **Super Admin** privileges. *** ## Step 2 — Create a Custom SAML App 1. In the left sidebar: `Apps → Web and mobile apps → Add app → Add custom SAML app` 2. Enter an app name such as **“Open WebUI (Arthur)”** 3. (Optional) Upload your company or Arthur logo for easy identification. 4. Click **Continue** *** ## Step 3 — Download Google’s IdP Information Google will now display: * **SSO URL** * **Entity ID** * **Certificate (X.509)** 📤 **Send these three values to your Arthur contact or Keycloak administrator.** They will configure them inside Keycloak to establish trust between Google and Keycloak. Then click **Continue**. *** ## Step 4 — Enter Arthur’s Keycloak Information On the next screen, fill in the service provider details **exactly as follows**: | Field | Value | | -------------------------------------------- | --------------------------------------------------------------------------- | | **ACS URL (Assertion Consumer Service URL)** | `https://.arthur.ai/realms/openwebui/broker/google/endpoint` | | **Entity ID** | `https://.arthur.ai/realms/openwebui` | | **Start URL** | *(Leave blank)* | | **Signed Response** | ✅ Checked | | **Name ID format** | `EMAIL` | | **Name ID** | `Basic Information > Primary Email` | Then click **Continue**. *** ## Step 5 — Add Attribute Mappings This section defines what user information is sent to Keycloak. Add the following mappings: | Google Directory Attribute | App Attribute | | -------------------------- | ------------- | | `Primary Email` | `email` | | `First Name` | `firstName` | | `Last Name` | `lastName` | | `Groups` | `Groups` | ### **Tip:** The `Groups` attribute is what enables role mapping (e.g. admin/user) inside Keycloak. Click **Continue**. *** ## ⚙️ Step 6 — Add Group Memberships (for Admin/User roles) You’ll now see a section titled **“Group membership (optional)”**. This is where you define which Google Groups get sent to Keycloak. 1. Under **Google groups**, click the field and add: * `openwebui-admins@yourcompany.com` * `openwebui-users@yourcompany.com` (Or whatever group emails your organization will use.) 2. Under **App attribute**, type: `Groups` Example configuration: | Google groups | App attribute | | --------------------------------------------------------------------- | ------------- | | `openwebui-admins@yourcompany.com`, `openwebui-users@yourcompany.com` | `Groups` | 3. Click **Finish** *** ## Step 7 — Assign Access By default, your new SAML app is **off for everyone**. To allow users to log in: 1. Go to the app you just created under `Apps → Web and mobile apps` 2. Click the new **Open WebUI (Arthur)** app 3. Under **User Access**, set: `ON for everyone` or restrict to specific organizational units (OUs) if needed. ## Step 8 — Send Information to Arthur (Keycloak Admin) Provide your Arthur contact or Keycloak admin with the following information: | Item | Description | | --------------------- | --------------------------------------- | | **SSO URL** | From Step 3 | | **Entity ID** | From Step 3 | | **X.509 Certificate** | From Step 3 | | **Admin Group(s)** | e.g. `openwebui-admins@yourcompany.com` | | **User Group(s)** | e.g. `openwebui-users@yourcompany.com` | Arthur’s team will configure these inside Keycloak to complete the connection. *** ## How Keycloak Uses This Information Arthur’s Keycloak admin will: 1. Create two **realm roles**: `admin` and `user` 2. Add **mappers** in Keycloak that translate Google Groups → roles: * `Groups = openwebui-admins@yourcompany.com` → `admin` * `Groups = openwebui-users@yourcompany.com` → `user` 3. Test logins from both groups to confirm correct role assignment. When a user logs into Open WebUI via Keycloak: * If they belong to the **admin group**, they’ll get full admin privileges. * If they belong to the **user group**, they’ll get standard user access. *** ## Summary | Step | Action | | ---- | ------------------------------------------------------------- | | 1 | Go to [admin.google.com](https://admin.google.com) | | 2 | Add **Custom SAML App** → name it *Open WebUI (Arthur)* | | 3 | Copy Google IdP details (SSO URL, Entity ID, Certificate) | | 4 | Enter Arthur’s Keycloak ACS URL and Entity ID | | 5 | Map attributes: `email`, `firstName`, `lastName`, `Groups` | | 6 | Add Google groups → set App Attribute to `Groups` | | 7 | Turn app **ON for everyone** | | 8 | Send information + group names to Arthur for Keycloak mapping | *** ## Example Group Design (Recommended) | Group Name | Example Address | Purpose | | -------------------- | ---------------------------------- | -------------------------------- | | **OpenWebUI Admins** | `openwebui-admins@yourcompany.com` | Members become Open WebUI admins | | **OpenWebUI Users** | `openwebui-users@yourcompany.com` | Members become regular users | These groups can be managed directly by your organization’s IT team to control Open WebUI permissions dynamically — no need for Arthur to change anything. *** ## End Result | Google Group | Keycloak Role | Open WebUI Access | | ---------------------------------- | ------------------------------ | --------------------- | | `openwebui-admins@yourcompany.com` | `admin` | Full admin privileges | | `openwebui-users@yourcompany.com` | `user` | Standard user access | | (no group match) | *(optional default user role)* | Basic user access | *** **That’s it!** Your organization is now configured to use **Google SAML SSO** for Open WebUI via Arthur’s Keycloak. All role assignments are fully automated through your existing Google Groups.