My1login

My1Login is a cloud-based identity and access management (IAM) platform that unifies standards-based single sign-on (SSO) with an enterprise password manager, allowing organizations to manage both federated and non-federated applications securely. It functions as a SAML 2.0 and OpenID Connect (OIDC) Identity Provider (IdP), offers passwordless SSO for compatible SaaS apps, and integrates external MFA providers.

Key Capabilities

• Standards-based federation: Supports SAML 2.0 and OpenID Connect/OAuth 2.0 for modern app federation. Vendor documentation highlights passwordless SSO for compatible SaaS applications using these protocols.

• Coverage for non-federated and legacy apps: The Enterprise Password Manager enables secure web authentication and SSO for credential-based or legacy systems, including Windows desktop applications, while keeping credentials hidden from end users.

• MFA and step-up authentication: Integrates with third-party MFA solutions and supports automated one-time passwords (OTP) within SSO flows. Policies can enforce step-up MFA for high-risk or sensitive applications.

• Provisioning capabilities: Includes a user provisioning module for onboarding, de-provisioning, and Just-in-Time (JIT) provisioning. Vendor materials and CSA STAR listings reference SCIM among supported standards for lifecycle automation.

Limitations

• Protocol depth: Public documentation focuses on core SAML/OIDC/OAuth 2.0 features; there is insufficient information to confirm support for advanced OAuth profiles like PAR, DPoP, mTLS, or FAPI.

• SCIM detail and scope: While SCIM is mentioned in collateral and compliance registries, there is no clear documentation of general-purpose SCIM 2.0 provider endpoints or schema specifics for full lifecycle automation.

• MFA native factors: The platform primarily integrates with third-party MFA and OTP solutions; there is no public confirmation of native FIDO2/WebAuthn support.

• OIDC IdP documentation depth: Although My1Login claims IdP capabilities for both SAML and OIDC, detailed OIDC configuration and claim-mapping documentation is less visible—organizations should validate required features for their relying parties.