Centralizing Enterprise AI: A Step-by-Step Guide to Deploying OpenWebUI with Keycloak SSO on a VPS

Introduction: The Challenge of Enterprise AI Adoption

As Artificial Intelligence becomes an indispensable tool for modern business operations, organizations face a critical dilemma. Allowing employees to use fragmented, public AI tools introduces severe data privacy risks and unpredictable subscription costs. Conversely, restricting AI access entirely hinders productivity and innovation.

The optimal solution lies in establishing a centralized, self-hosted AI gateway. By deploying OpenWebUI as a unified interface and securing it via Keycloak Single Sign-On (SSO) on a Virtual Private Server (VPS), enterprises can deliver powerful AI capabilities to their entire workforce while maintaining absolute control over data privacy, user access, and operational costs. This guide provides a comprehensive blueprint for implementing this enterprise-ready architecture.

The Architecture: OpenWebUI, Keycloak, and VPS

Before diving into the implementation steps, it is essential to understand how these technologies interact to create a secure enterprise AI environment:

• VPS (Virtual Private Server): Serves as the independent, scalable infrastructure hosting the entire stack, ensuring that your data never leaves your controlled environment.
• OpenWebUI: An advanced, highly customizable user interface that connects to various AI backends (like Ollama, OpenAI API, or Anthropic). It offers features like chat history sharing, custom prompts, and RAG (Retrieval-Augmented Generation).
• Keycloak: An open-source Identity and Access Management (IAM) solution. It acts as the central authentication provider, enforcing robust security policies and managing user permissions via OAuth2 or OpenID Connect (OIDC).

By leveraging this stack, businesses eliminate the need for individual AI accounts. Employees log in using their standard corporate credentials, and administrators can dynamically grant or revoke access based on roles or departments.

Prerequisites and System Requirements

To ensure a smooth deployment, your VPS should meet the following minimum specifications, depending on whether you intend to host language models locally or connect via APIs:

• For API-driven setups (OpenAI, Claude, Azure OpenAI): 2 vCPUs, 4GB RAM, and 40GB SSD.
• For local model hosting (via Ollama): Minimum 4 vCPUs, 16GB RAM, and a dedicated GPU (e.g., NVIDIA T4 or A10G) with ample storage for model weights.
• Operating System: Ubuntu 22.04 LTS or 24.04 LTS is highly recommended.
• Domain and SSL: A registered domain name with DNS records pointing to your VPS IP address, and SSL certificates (via Let's Encrypt).

Step 1: Preparing the VPS Environment

First, update your system packages and install Docker and Docker Compose, which will isolate and manage our application services efficiently.

sudo apt update && sudo apt upgrade -y
sudo apt install docker.io docker-compose -y
sudo systemctl enable --now docker

Next, configure a reverse proxy like Nginx or Traefik to handle incoming HTTPS traffic and route it safely to OpenWebUI and Keycloak. Security is paramount when dealing with proprietary corporate data.

Step 2: Deploying and Configuring Keycloak SSO

Deploy Keycloak using Docker Compose. Create a docker-compose.yml file tailored for your IAM services, ensuring persistence using a database like PostgreSQL.

Once Keycloak is up and running, navigate to the admin console to configure your enterprise realm:

1. Create a Realm: Name it something specific to your organization (e.g., Company-AI).
2. Create a Client: Set up a new client for OpenWebUI. Select openid-connect as the protocol and set the Access Type to confidential.
3. Configure Redirect URIs: Set the Valid Redirect URIs to your OpenWebUI domain followed by the OAuth callback path (e.g., [https://ai.yourcompany.com/oauth/oidc/callback](https://ai.yourcompany.com/oauth/oidc/callback)).
4. Define Roles and Groups: Create groups such as AI-Users and AI-Admins to control feature access within OpenWebUI.

Note down the Client ID and the generated Client Secret from the Credentials tab; these will be crucial for connecting OpenWebUI in the next step.

Step 3: Deploying OpenWebUI with OIDC Integration

Now, deploy OpenWebUI. The integration with Keycloak is handled seamlessly via environment variables passed to the OpenWebUI Docker container. Below is an example configuration snippet for your deployment script:

OPENWEBUI_SECRET_KEY=your_super_secret_key
ENABLE_OAUTH_SIGNUP=true
OAUTH_MERGE_ACCOUNTS_BY_EMAIL=true
OIDC_PROVIDER_AUTHENTICATION_NAME=Company SSO
OPENID_CONNECT_CLIENT_ID=openwebui-client
OPENID_CONNECT_CLIENT_SECRET=your_keycloak_client_secret
OIDC_ISSUER_URL=[https://sso.yourcompany.com/realms/Company-AI](https://sso.yourcompany.com/realms/Company-AI)

By setting ENABLE_OAUTH_SIGNUP=true, new employees who are authenticated through Keycloak will automatically have an account provisioned for them on their first login, minimizing administrative overhead.

Step 4: Managing Role-Based Permissions

With Keycloak managing authentication, you can enforce strict access controls. OpenWebUI allows you to map Keycloak roles to internal application permissions. For example:

• Standard Employees: Assigned to the AI-Users group, granting access to general productivity models (e.g., GPT-4o for drafting text or summarizing reports).
• Data Analysis Team: Granted access to specialized, high-context models or specific internal RAG knowledge bases containing financial or operational data.
• IT Administrators: Assigned the AI-Admins role, allowing them to monitor usage metrics, configure system-wide prompts, and modify model availability.

This granular control ensures compliance with internal data governance policies and prevents unauthorized access to sensitive company intelligence.

Best Practices for Enterprise AI Deployment

Deploying the software is only the first step. To guarantee a resilient and compliant system, adhere to these enterprise best practices:

1. Implement Strict Data Retention Policies

Configure OpenWebUI to anonymize or purge chat histories periodically if required by local regulations (such as GDPR). Ensure that data used for RAG is encrypted both at rest and in transit.

2. Monitor API Usage and Costs

If you are utilizing commercial APIs, set up strict monthly spending limits within your OpenAI or Anthropic dashboards. Monitor OpenWebUI logs to identify unusual traffic spikes or potential misuses of AI resources.

3. Continuous Backups

Automate daily backups of your Keycloak database and OpenWebUI database volumes. In the event of a VPS failure, a robust backup strategy allows you to restore services within minutes, ensuring business continuity.

Conclusion

Implementing OpenWebUI with Keycloak SSO on a VPS provides modern enterprises with the perfect balance of technological empowerment and stringent security. By centralizing AI access, your company drastically reduces subscription costs, prevents Shadow IT, and ensures that corporate data remains entirely within your sphere of control. As AI continues to evolve, this self-hosted gateway serves as a future-proof foundation for scaling intelligent automation across your entire workforce.