Salesforce as service provider - how to enforce user to re-enter credentials every time when calling identity provider endpoint

Use Case:

We have a single sign on endpoint configured on salesforce as service provider with PingFederate Enterprise Server serving as identity provider. A managed package eSignature process uses this endpoint to let users re-authenticate on every eSignature request.

Problem:

The user name / password challenge is only brought up once. Following eSignature calls use the session already existing. There is a SSO Option ForceAuthn=true to enforce authentication on every request.

Appending this to the IdP endpoint URL when calling does not work.

Is there a way to configure this as part of the Salesforce SSO endpoint configuration?

Thank you.