IDPs can be asked to force (re)authentication of users rather than allowing existing sessions to be reused.