Canada begins gradual rollout of SSO for digital government services

Canada’s government is boldly leading the country’s digital public services into the present, or at least the recent past.

A single sign-on (SSO) service called “CanadaLogin” was introduced this week with little fanfare, but with a roadmap and ambitions to remake Canada’s online federal government services with enhanced security, convenience and usability.

Currently, Canadian use any of 90 different paths to access more than 270 online services provided by the federal government.

The government wants to transition to a similar kind of “one citizen, one account” approach seen in many countries around the world. The transition will be gradual, however, “starting with small and non-critical services.” Eventually it will integrate existing systems like My Service Canada Accounts and CRA (Canada Revenue Agency) accounts.

The first set of services using CanadaLogin include Western Canadian grant programs PrariesCan and PacifiCan, Veterans Affairs healthcare documentation portal and the Canadian Grains Commission’s reporting portal.

The SSO service, developed by Canadian Digital Services (CDS), supports OpenID Connect and uses 2-step verification through a one-time passcode, a passkey or a security key. Passkey-based account recovery and SAML protocol support are expected by March of next year.

A roadmap to reach the present (by next September)

If that all sounds like a system not yet ready to defend against sophisticated fraud, CanadaLogin plans to launch Identity Assurance Level 2 (IAL2), which typically means face biometrics to bind the identity to a government-issued document, between April and September of 2027.

Next steps in the same time frame will include adding support for provincial and territory IDs, like those from Alberta and British Columbia, Interac sign-in partners and additional two-factor authentication (2FA) options.

DIACC noted the successes of the BC Services Card and the province’s plan to launch a digital equivalent during 2026 in its report released this month on making digital IDs more useful in the country.

CDS also plans to build a migration solution for the Government of Canada Credential Federation (GCCF) Consolidator, a centralized authentication broker service which connects applications, users and credentials like GCKey, which was criticized for its weak authentication security by Canada’s Privacy Commissioner in 2024.

CanadaLogin can currently handle over 1.4 million transactions per hour.

A neighborly caution

The country’s southern neighbor has also taken steps to modernize its digital delivery of  federal public services. The U.S. has awarded standalone contracts with identity verification vendors like Incode, while Canada is turning to an existing partnership with IBM Canada.

America’s experience suggests the government of Canada should be prepared for logistical hurdles, user confusion and complaints about friction.

Support for multifactor authentication (MFA) is coming to CanadaLogin. Between next October and March 2028, Credential Assurance Level 3 will be added, along with either direct integrations or migration guidance for GCKey and sign-in services from Interac.

Interac has exclusive Canadian rights to deploy Incode’s ID document verification, biometrics, liveness detection and IAD checks for identity verification. CDS says the government may choose to continue offering authentication from Interac through additional funding and a new procurement, which would position Incode to handle the IDV process.

After current funding and mandate run out in early-2028, the government wants to continue moving toward IAL3, business profiles and delegation capabilities, according to the roadmap.

Article Topics

Canada  |  CanadaLogin  |  digital government  |  digital identity  |  IAL2  |  single sign-on