diff --git a/README.md b/README.md
index f7df7d7..73927aa 100644
--- a/README.md
+++ b/README.md
@@ -145,6 +145,11 @@
 
 Default is `86400`
 
+**saml.forceAuth**: (Optional) Whether to force authentication with the IdP, when
+the session in Gerrit expires.
+
+Default is `false`
+
 **saml.displayNameAttr**: Gerrit will look for an attribute with this name in
 the assertion to find a display name for the user. If the attribute is not
 found, the NameId from the SAML assertion is used instead.
diff --git a/src/main/java/com/googlesource/gerrit/plugins/saml/SamlClientProvider.java b/src/main/java/com/googlesource/gerrit/plugins/saml/SamlClientProvider.java
index 9d5d047..4bb32a2 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/saml/SamlClientProvider.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/saml/SamlClientProvider.java
@@ -67,6 +67,8 @@
       }
     }
 
+    samlClientConfig.setForceAuth(samlConfig.getForceAuthAttr());
+
     samlClientConfig.setUseNameQualifier(samlConfig.useNameQualifier());
     samlClientConfig.setMaximumAuthenticationLifetime(samlConfig.getMaxAuthLifetimeAttr());
 
diff --git a/src/main/java/com/googlesource/gerrit/plugins/saml/SamlConfig.java b/src/main/java/com/googlesource/gerrit/plugins/saml/SamlConfig.java
index 96c591c..ca6c45e 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/saml/SamlConfig.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/saml/SamlConfig.java
@@ -38,6 +38,7 @@
   private final String firstNameAttr;
   private final String lastNameAttr;
   private final int maxAuthLifetimeDefault = 24 * 60 * 60; // 24h;
+  private final boolean forceAuth;
   private final boolean useNameQualifier;
   private final String memberOfAttr;
 
@@ -54,6 +55,7 @@
     userNameAttr = getStringWithDefault(cfg, "userNameAttr", "UserName");
     emailAddressAttr = getStringWithDefault(cfg, "emailAddressAttr", "EmailAddress");
     maxAuthLifetimeAttr = cfg.getInt("saml", "maxAuthLifetime", maxAuthLifetimeDefault);
+    forceAuth = cfg.getBoolean(SAML_SECTION, "forceAuth", false);
     computedDisplayName = cfg.getBoolean(SAML_SECTION, "computedDisplayName", false);
     firstNameAttr = getStringWithDefault(cfg, "firstNameAttr", "FirstName");
     lastNameAttr = getStringWithDefault(cfg, "lastNameAttr", "LastName");
@@ -93,6 +95,10 @@
     return maxAuthLifetimeAttr;
   }
 
+  public boolean getForceAuthAttr() {
+    return forceAuth;
+  }
+
   private static String getString(Config cfg, String name) {
     return cfg.getString(SAML_SECTION, null, name);
   }