Hi @boospy,
as far as I can see the ServerRole in the ini file does not limit to where the app could actually be installed (so you could also install it on a simple member). The default configuration kind of expects the the app to run where your ucs-sso subdomain is hosted, though.
Theoretically its possible to install it on multiple hosts, but I don’t think the Univention team has implemented something to sync keys between installations, yet.