Why doesn't mydomain login work when single signon is enabled?

Short answer:

  When attempting mydomain login, the user's profile (or permission set) has Is Single SignOn Enabled = true

If you have somehow done this to Profile System Administrator and

  no other profile/user has Customize Application privileges or no other user w/ Customize Application privileges is logged in to undo (in Setup) the Is Single Signon Enabled=true

and your IdP is offline
You'll be making a phone call to SFDC Support!
Longer answer
The doc also states...

We recommend that you don’t enable SSO for Salesforce admins. If your Salesforce admins are SSO users and your SSO server has an outage, they have no way to log in to Salesforce. Make sure that Salesforce admins can log in to Salesforce so that they can disable SSO if problems occur.

This is a bit misleading. You should not enable the Is Single Signon = true for Sysads but you certainly can enable a SAML SSO for system admins by configuring My Domain as shown below
If you enter https://mydomain.my.salesforce.com/?login=true in the browser, you will see:
and, assuming you remember your password, you can login and bypass the IdP.
So - you can:

Set Is Single Signon Enabled = true for all users except Sysads (this prevents them from using the ?login=true URL param)
Disable the Login Form in My Domain so no one worries about the username/pw anymore (the whole point of SSO/IdP)
Still allow Sysads to login with http://mydomain.my.salesforce.com/?login=true to provide access to Setup in case an IdP is down or misconfigured.