Set up OpenwebUI on Docker with Foundry and Entra ID Authentication (Caddy)

Last week I was asked to set up an GenAI Chat solution for an workshop and decided to use OpenWebUI GitHub – open-webui/open-webui: User-friendly AI Interface (Supports Ollama, OpenAI API, …) · GitHub which is a pretty flexible solution in terms of using your own data, supporting different models and authentication methods (and its free!)

Since this was for a shortlived enviroment I decided that setting up a single VM (with some faster disk since RAG can become quite disk intensive) was the right approach. So this solution uses (Letsencrypt for certificates, Caddy for reverse proxy, OpenwebUI as the web interface, Postgres as the vector store, Foundry for inferencing and Entra ID for authentication)

Important to note that for Entra ID authentication to work you need a public DNS record that you can assign to the public IP of the machine.

1. Public DNS A record points your hostname to the VM public IP.
2. Ports 443 are open on NSG/firewall.
3. You are using one auth mode only:
4. Microsoft OIDC with OAUTH_CLIENT_ID, OAUTH_CLIENT_SECRET, OPENID_PROVIDER_URL, OPENID_REDIRECT_URI enviroment variable
   NOTE: Do not mix with Microsoft-specific mode variables unless you intentionally switch modes.

1: Set up a Ubuntu machine with Docker

sudo apt update
sudo apt install ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

sudo tee /etc/apt/sources.list.d/docker.sources <<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOF

sudo apt update
sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

Then we need to install Caddy and letsencrypt. NOTE We need HTTP open to complete the certbot challenge and this will then generate a certificate which is stored locally.

sudo apt install letsencrypt
sudo certbot certonly --standalone --agree-tos --preferred-challenges http -d domain-name.com

Setting up Caddy

sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https curl

curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' \
  | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg

curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' \
  | sudo tee /etc/apt/sources.list.d/caddy-stable.list

sudo chmod o+r /usr/share/keyrings/caddy-stable-archive-keyring.gpg
sudo chmod o+r /etc/apt/sources.list.d/caddy-stable.list

sudo apt update
sudo apt install -y caddy

Then we need to make a change to the Caddy configuration file to proxy the connection and handle the certificate. The configuration file is stored under /etc/caddy/Caddyfile.
This is the configuration file that I have and handles redirect and the certificate.

http://arecorddomain.com {
redir https://arecorddomain.com{uri} permanent
}
https://arecorddomain.com {
tls /etc/letsencrypt/live/arecorddomain.com/fullchain.pem /etc/letsencrypt/live/arecorddomain.com/privkey.pem
reverse_proxy localhost:3000
}
:80 {
root * /usr/share/caddy
file_server
}

The final thing is to restart Caddy.

sudo systemctl start caddy
sudo systemctl reload caddy

2: Set up Entra ID App Registration

Go to Entra ID –> App Registrations –> New Registration –> Give it a name and enter the following as redirect URI https://publicdomain/oauth/microsoft/callback
Then collect the following information of the app registration

• ClientID / Application ID
• Tenant ID
• Client Secret (You need to create one)

Which you need use in the configuration below.

3: Set up OpenwebUI Docker Container

By default OpenWebUI does not persist configuration to the database, which is something I wanted it to do so that each time the container restarted it would pick up the config from the local filestore, and secondly this is also where you enable OIDC authentication.

Then I run this command to pull the docker image with the correct enviroment variables

sudo docker run -d --restart unless-stopped
-p 3000:8080
-v open-webui:/app/backend/data
--name open-webui
-e WEBUI_URL=https://DOMAIN
-e ENABLE_OAUTH=true
-e OAUTH_PROVIDER_NAME=EntraID
-e OAUTH_CLIENT_ID=CLIENT_ID
-e OAUTH_CLIENT_SECRET=CLIENT_SECRET
-e OPENID_PROVIDER_URL=https://login.microsoftonline.com/TENANT_ID/v2.0/.well-known/openid-configuration
-e OPENID_REDIRECT_URI=https://DOMAIN/oauth/oidc/callback
-e OAUTH_SCOPES="openid email profile"
ghcr.io/open-webui/open-webui:main

This should then be exposed trough the public IP address of the machine, and it is of course important that the WebUI URL is correct and that the OpenID Configuration is correct, or else the SSO button will not show.

Once you have it configured and to start the container, and go to the main page the Entra ID Button should appear as in the screenshot below