Okta Setup for OpenWebUI

Once configured, users can log in to Open WebUI through Okta SSO, and Keycloak will automatically assign admin or user roles based on Okta groups.

---

Step 1 — Sign in to Okta Admin Console

1. Go to https://admin.okta.com
2. Sign in with an account that has permissions to manage applications.
3. Navigate to: Applications → Applications → Create App Integration

---

Step 2 — Choose Integration Type

1. Under Sign-in method, select: SAML 2.0
2. Click Next.

---

Step 3 — Configure the SAML Application

General Settings

Click Next.

---

SAML Settings

Replace {AUTH_BASE_URL} and {REALM} with your tenant’s values, for example:
https://auth-development.arthur.ai and openwebui.

Click Next.

---

Step 4 — Attribute Statements

Add the following attribute mappings:

The getFilteredGroups function ensures that only Okta groups prefixed with openwebui- are sent in the SAML response.
You can modify this filter or remove it if you want all groups to be sent.

Click Next.

---

Step 5 — Feedback

Select the following options:

• “I’m an Okta customer adding an internal app”
• “This is an internal app that we created”

Click Finish.

---

Step 6 — Obtain Okta SAML Metadata

1. Go to the new app’s Sign On tab.
2. Click View SAML setup instructions.
3. Copy the following values and provide them to your Arthur contact:

---

Step 7 — Assign Users or Groups

1. In Okta, go to the new app → Assignments tab.
2. Click Assign → Assign to Groups.
3. Assign the relevant groups:

• openwebui-admins → admin users
• openwebui-users → standard users

If your organization uses different group names, provide them to Arthur so they can be mapped appropriately in Keycloak.

---

Step 8 — Send Information to Arthur (Keycloak Admin)

Send the following information to your Arthur contact or Keycloak administrator:

Arthur’s team will configure these in Keycloak to complete the connection.

---

Summary of Configuration (Okta Side)

---

End Result

Once configured, users log into Open WebUI using their Okta credentials, and Keycloak automatically maps their group membership to the appropriate access level.