diff --git a/app/assets/javascripts/vue_merge_request_widget/components/approvals/approvals.vue b/app/assets/javascripts/vue_merge_request_widget/components/approvals/approvals.vue
index a29393d9f93c44c543c04850bfd0e8167f2342e6..524f2c045e6fa785cd3fe80bdce7ea39409516ba 100644
--- a/app/assets/javascripts/vue_merge_request_widget/components/approvals/approvals.vue
+++ b/app/assets/javascripts/vue_merge_request_widget/components/approvals/approvals.vue
@@ -1,6 +1,7 @@
 <script>
 import { GlButton, GlSprintf } from '@gitlab/ui';
 import { createAlert } from '~/alert';
+import { visitUrl } from '~/lib/utils/url_utility';
 import { STATUS_MERGED } from '~/issues/constants';
 import { BV_SHOW_MODAL } from '~/lib/utils/constants';
 import { HTTP_STATUS_UNAUTHORIZED } from '~/lib/utils/http_status';
@@ -114,6 +115,13 @@ export default {
       return this.userHasApproved && !this.userCanApprove && this.mr.state !== STATUS_MERGED;
     },
     approvalText() {
+      // Repeating a text of this to keep i18n easier to do (vs, construcing a compound string)
+      if (this.requireSamlAuthToApprove) {
+        return this.isApproved && this.approvedBy.length > 0
+          ? s__('mrWidget|Approve additionally with SAML')
+          : s__('mrWidget|Approve with SAML');
+      }
+
       return this.isApproved && this.approvedBy.length > 0
         ? s__('mrWidget|Approve additionally')
         : s__('mrWidget|Approve');
@@ -161,14 +169,20 @@ export default {
         .join(', ')
         .concat('.');
     },
+    requireSamlAuthToApprove() {
+      return this.mr.requireSamlAuthToApprove;
+    },
   },
   methods: {
     approve() {
+      if (this.requireSamlAuthToApprove) {
+        this.approveWithSamlAuth();
+        return;
+      }
       if (this.requirePasswordToApprove) {
         this.$root.$emit(BV_SHOW_MODAL, this.modalId);
         return;
       }
-
       this.updateApproval(
         () => this.service.approveMergeRequest(),
         () =>
@@ -179,6 +193,10 @@ export default {
           ),
       );
     },
+    approveWithSamlAuth() {
+      // Intentionally direct to SAML Identity Provider for renewed authorization even if SSO session exists
+      visitUrl(this.mr.samlApprovalPath);
+    },
     approveWithAuth(data) {
       this.updateApproval(
         () => this.service.approveMergeRequestWithAuth(data),
diff --git a/ee/app/assets/javascripts/approvals/constants.js b/ee/app/assets/javascripts/approvals/constants.js
index 70022f9be4bc6064755b0e2675b80fd121ac3f26..963511ad306d19eee4e54821368662bd678cd703 100644
--- a/ee/app/assets/javascripts/approvals/constants.js
+++ b/ee/app/assets/javascripts/approvals/constants.js
@@ -56,7 +56,9 @@ export const PROJECT_APPROVAL_SETTINGS_LABELS_I18N = {
   preventCommittersApprovalLabel: s__(
     'ApprovalSettings|Prevent approvals by users who add commits',
   ),
-  requireUserPasswordLabel: s__('ApprovalSettings|Require user password to approve'),
+  requireUserPasswordLabel: s__(
+    'ApprovalSettings|Require user re-authentication (password or SAML) to approve',
+  ),
   whenCommitAddedLabel: s__('ApprovalSettings|When a commit is added:'),
   keepApprovalsLabel: s__('ApprovalSettings|Keep approvals'),
   removeApprovalsOnPushLabel: s__('ApprovalSettings|Remove all approvals'),
diff --git a/ee/app/assets/javascripts/vue_merge_request_widget/stores/mr_widget_store.js b/ee/app/assets/javascripts/vue_merge_request_widget/stores/mr_widget_store.js
index 9dd1f4ad4603fbd06b7a44d0b937cf79f05188af..1c56ec101c11eefec247cf6b7ae48580ad7dbd5a 100644
--- a/ee/app/assets/javascripts/vue_merge_request_widget/stores/mr_widget_store.js
+++ b/ee/app/assets/javascripts/vue_merge_request_widget/stores/mr_widget_store.js
@@ -29,6 +29,7 @@ export default class MergeRequestStore extends CEMergeRequestStore {
     this.appUrl = gon && gon.gitlab_url;
     this.licenseScanning = data.license_scanning;
     this.requirePasswordToApprove = data.require_password_to_approve;
+    this.requireSamlAuthToApprove = data.require_saml_auth_to_approve;
     this.mergeRequestApproversAvailable = data.merge_request_approvers_available;
     this.aiCommitMessageEnabled = data.aiCommitMessageEnabled;
 
@@ -62,6 +63,7 @@ export default class MergeRequestStore extends CEMergeRequestStore {
 
     this.discoverProjectSecurityPath = data.discover_project_security_path;
     this.apiStatusChecksPath = data.api_status_checks_path;
+    this.samlApprovalPath = data.saml_approval_path;
 
     // Security scan diff paths
     this.containerScanningComparisonPath = data.container_scanning_comparison_path;
diff --git a/ee/app/controllers/projects/merge_requests/saml_approvals_controller.rb b/ee/app/controllers/projects/merge_requests/saml_approvals_controller.rb
new file mode 100644
index 0000000000000000000000000000000000000000..6f727d5445f3feeaf80a1a7af0d796e8548c41f2
--- /dev/null
+++ b/ee/app/controllers/projects/merge_requests/saml_approvals_controller.rb
@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+module Projects
+  module MergeRequests
+    class SamlApprovalsController < Projects::ApplicationController
+      feature_category :code_review_workflow
+
+      def create
+        return render_404 unless merge_request
+
+        result = ::MergeRequests::ApprovalService
+          .new(project: project, current_user: current_user)
+          .execute(merge_request)
+
+        if result
+          flash[:notice] = _("Approved")
+        else
+          flash[:alert] = _("Approval rejected.")
+        end
+
+        redirect_to(
+          namespace_project_merge_request_path(
+            id: merge_request_iid,
+            project_id: merge_request.project,
+            namespace_id: merge_request.project.namespace
+          )
+        )
+      end
+
+      private
+
+      def project_id
+        project.id
+      end
+
+      def group_id
+        project.group.id
+      end
+
+      def merge_request_iid
+        params.permit(:id).fetch(:id)
+      end
+
+      def merge_request
+        @merge_request ||= MergeRequestsFinder.new(
+          current_user,
+          group_id: group_id,
+          project_id: project_id,
+          iids: [merge_request_iid]
+        ).execute&.first
+      end
+    end
+  end
+end
diff --git a/ee/app/helpers/ee/projects_helper.rb b/ee/app/helpers/ee/projects_helper.rb
index 9350669b53b69103ec362d6bfacdd8f9ea865f7a..9d1099f7bd6836a36803265ebb3513f65b9c7a56 100644
--- a/ee/app/helpers/ee/projects_helper.rb
+++ b/ee/app/helpers/ee/projects_helper.rb
@@ -62,6 +62,7 @@ def approvals_app_data(project = @project)
         can_edit: can_modify_approvers.to_s,
         can_modify_author_settings: can_modify_author_settings.to_s,
         can_modify_commiter_settings: can_modify_commiter_settings.to_s,
+        saml_provider_enabled: saml_provider_enabled_for_project?(project).to_s,
         project_path: expose_path(api_v4_projects_path(id: project.id)),
         approvals_path: expose_path(api_v4_projects_merge_request_approval_setting_path(id: project.id)),
         rules_path: expose_path(api_v4_projects_approval_rules_path(id: project.id)),
@@ -75,6 +76,13 @@ def approvals_app_data(project = @project)
       }
     end
 
+    def saml_provider_enabled_for_project?(project)
+      group = project.root_ancestor
+      return false unless group.is_a? Group
+
+      !!group.saml_provider&.enabled?
+    end
+
     def status_checks_app_data(project)
       {
         data: {
diff --git a/ee/app/helpers/groups/sso_helper.rb b/ee/app/helpers/groups/sso_helper.rb
index d2d0474585a124b6c49cc2007f1ac96b57ba3b81..fae13eeee3333d1356dadd18b937f7c2582c39a4 100644
--- a/ee/app/helpers/groups/sso_helper.rb
+++ b/ee/app/helpers/groups/sso_helper.rb
@@ -15,4 +15,10 @@ def authorize_gma_conversion_confirm_modal_data(group_name:, phrase:, remove_for
       phrase: phrase
     }
   end
+
+  def saml_provider_enabled?(group = nil)
+    return false unless group.is_a? Group
+
+    !!group.root_ancestor.saml_provider&.enabled?
+  end
 end
diff --git a/ee/app/models/group_merge_request_approval_setting.rb b/ee/app/models/group_merge_request_approval_setting.rb
index 5685c3a5412f451b91f0559006133a8b6cef417f..a2d8d8cbc2f06c3eec5d9b3b4c0b7bf6ee813062 100644
--- a/ee/app/models/group_merge_request_approval_setting.rb
+++ b/ee/app/models/group_merge_request_approval_setting.rb
@@ -11,16 +11,19 @@ class GroupMergeRequestApprovalSetting < ApplicationRecord
     :allow_overrides_to_approver_list_per_merge_request,
     :retain_approvals_on_push,
     :require_password_to_approve,
+    :require_saml_auth_to_approve,
     inclusion: { in: [true, false], message: N_('must be a boolean value') }
 
   scope :find_or_initialize_by_group, ->(group) { find_or_initialize_by(group: group) }
 
-  AUDIT_LOG_ALLOWLIST = { allow_author_approval: 'prevent merge request approval from authors',
-                          allow_committer_approval: 'prevent merge request approval from committers',
-                          allow_overrides_to_approver_list_per_merge_request:
-                            'prevent users from modifying MR approval rules in merge requests',
-                          retain_approvals_on_push: 'require new approvals when new commits are added to an MR',
-                          require_password_to_approve: 'require user password for approvals' }.freeze
+  AUDIT_LOG_ALLOWLIST = {
+    allow_author_approval: 'prevent merge request approval from authors',
+    allow_committer_approval: 'prevent merge request approval from committers',
+    allow_overrides_to_approver_list_per_merge_request:
+    'prevent users from modifying MR approval rules in merge requests',
+    retain_approvals_on_push: 'require new approvals when new commits are added to an MR',
+    require_password_to_approve: 'require user password for approvals'
+  }.freeze
 
   def selective_code_owner_removals
     false
diff --git a/ee/app/presenters/ee/merge_request_presenter.rb b/ee/app/presenters/ee/merge_request_presenter.rb
index 1b86e5fbbf976a3f2723738874351810c3596d7a..fabd76dc5cf02396b09bcd09fc610f1cd355a9f6 100644
--- a/ee/app/presenters/ee/merge_request_presenter.rb
+++ b/ee/app/presenters/ee/merge_request_presenter.rb
@@ -66,8 +66,47 @@ def issue_keys
       ).issue_keys
     end
 
+    def saml_approval_path
+      return unless group.is_a?(Group) # feature does not work for personal namespaces
+
+      return unless group_requires_saml_auth_for_approval?
+
+      expose_path sso_group_saml_providers_path(
+        group,
+        token: group.saml_discovery_token,
+        redirect: saml_approval_redirect_path
+      )
+    end
+
+    def require_saml_auth_to_approve
+      group_requires_saml_auth_for_approval?
+    end
+
     private
 
+    def group
+      target_project.namespace
+    end
+
+    def group_requires_saml_auth_for_approval?
+      return false unless mr_approval_setting_password_required?
+
+      ::Gitlab::Auth::GroupSaml::SsoEnforcer.access_restricted?(
+        user: current_user,
+        resource: merge_request.project,
+        session_timeout: 0.seconds
+      )
+    end
+
+    def mr_approval_setting_password_required?
+      merge_request.require_password_to_approve?
+    end
+
+    def saml_approval_redirect_path
+      # Will not work with URL since the SSO controller will sanatize it
+      saml_approval_namespace_project_merge_request_path(group, target_project, merge_request.iid)
+    end
+
     def expose_mr_status_checks?
       current_user.present? &&
         project.external_status_checks.applicable_to_branch(merge_request.target_branch).any?
diff --git a/ee/app/serializers/ee/merge_request_widget_entity.rb b/ee/app/serializers/ee/merge_request_widget_entity.rb
index cfb847cb22979557e31d6200ab30e4308a8dcbe2..31822e0790f22316d117b5fa992a95a2a261747a 100644
--- a/ee/app/serializers/ee/merge_request_widget_entity.rb
+++ b/ee/app/serializers/ee/merge_request_widget_entity.rb
@@ -108,12 +108,14 @@ module MergeRequestWidgetEntity
       expose :merge_immediately_docs_path do |merge_request|
         presenter(merge_request).merge_immediately_docs_path
       end
-    end
 
-    def represent_blocking_mr(blocking_mr)
-      blocking_mr_options = options.merge(from_project: object.target_project)
+      expose :saml_approval_path do |merge_request|
+        presenter(merge_request).saml_approval_path
+      end
 
-      ::BlockingMergeRequestEntity.represent(blocking_mr, blocking_mr_options)
+      expose :require_saml_auth_to_approve do |merge_request|
+        presenter(merge_request).require_saml_auth_to_approve
+      end
     end
   end
 end
diff --git a/ee/app/services/ee/merge_requests/approval_service.rb b/ee/app/services/ee/merge_requests/approval_service.rb
index b28fe283820fdb658bdc962e143e1a9236d34474..97e8c66e3b227799e64d522b2fbdfe98e884f8c0 100644
--- a/ee/app/services/ee/merge_requests/approval_service.rb
+++ b/ee/app/services/ee/merge_requests/approval_service.rb
@@ -4,12 +4,20 @@ module EE
   module MergeRequests
     module ApprovalService
       extend ::Gitlab::Utils::Override
-
-      IncorrectApprovalPasswordError = Class.new(StandardError)
+      # 5 seconds is chosen arbitrarily to ensure the user needs to just have re-authenticated to approve
+      # Timeframe gives a short grace period for the callback from the identity provider to have processed.
+      SAML_APPROVE_TIMEOUT = 5.seconds
 
       override :execute
       def execute(merge_request)
-        return if incorrect_approval_password?(merge_request)
+        # TODO: rename merge request approval setting to require_reauthentication_to_approve
+        # Issue: https://gitlab.com/gitlab-org/gitlab/-/issues/431346
+        return super unless merge_request.require_password_to_approve?
+
+        require_saml_auth = approval_requires_saml_auth?(merge_request)
+
+        return if require_saml_auth && !saml_approval_in_time?
+        return if incorrect_approval_password?(merge_request) && !require_saml_auth
 
         super
       end
@@ -21,6 +29,26 @@ def incorrect_approval_password?(merge_request)
           !::Gitlab::Auth.find_with_user_password(current_user.username, params[:approval_password])
       end
 
+      def approval_requires_saml_auth?(merge_request)
+        ::Gitlab::Auth::GroupSaml::SsoEnforcer.access_restricted?(
+          user: current_user,
+          resource: merge_request.project,
+          session_timeout: 0.seconds
+        )
+      end
+
+      def saml_provider
+        project.group.root_saml_provider
+      end
+
+      def saml_approval_in_time?
+        return false unless saml_provider
+
+        ::Gitlab::Auth::GroupSaml::SsoState
+          .new(saml_provider.id)
+          .active_since?(SAML_APPROVE_TIMEOUT.ago)
+      end
+
       override :reset_approvals_cache
       def reset_approvals_cache(merge_request)
         merge_request.reset_approval_cache!
diff --git a/ee/app/views/groups/settings/merge_requests/_merge_request_approval_settings.html.haml b/ee/app/views/groups/settings/merge_requests/_merge_request_approval_settings.html.haml
index c796a72aeb2f232295278119da76ce0ad97ec2eb..7eefc3cce53796c174e591ba12079546980bc2bb 100644
--- a/ee/app/views/groups/settings/merge_requests/_merge_request_approval_settings.html.haml
+++ b/ee/app/views/groups/settings/merge_requests/_merge_request_approval_settings.html.haml
@@ -5,4 +5,4 @@
 - return unless show_merge_request_approval_settings?(user, group)
 
 - group_merge_request_approval_setting_api_path = expose_path(api_v4_groups_merge_request_approval_setting_path(id: group.id))
-%section#js-merge-request-approval-settings{ data: { default_expanded: expanded, approval_settings_path: group_merge_request_approval_setting_api_path } }
+%section#js-merge-request-approval-settings{ data: { default_expanded: expanded, approval_settings_path: group_merge_request_approval_setting_api_path, saml_provider_enabled: saml_provider_enabled?(group).to_s } }
diff --git a/ee/config/routes/merge_requests.rb b/ee/config/routes/merge_requests.rb
index 517e8a8075db265dbe5ea3e070502212bb843884..cff760b13b2362403040c9e9e0f7350f3e58c29f 100644
--- a/ee/config/routes/merge_requests.rb
+++ b/ee/config/routes/merge_requests.rb
@@ -16,6 +16,9 @@
     get :api_fuzzing_reports
     get :security_reports
 
+    # We intentionally need get here since this is invoked via a callback from the SAML Identity Provider(OmniAuth)
+    get :saml_approval, action: :create, controller: 'merge_requests/saml_approvals'
+
     post :rebase
   end
 
diff --git a/ee/lib/api/entities/merge_request_approval_setting.rb b/ee/lib/api/entities/merge_request_approval_setting.rb
index e4c7817b2a6cf72be6a2da63081fe59f8fb2f957..bc17b8c79dd683e4039246653e5d37b90a18ee9a 100644
--- a/ee/lib/api/entities/merge_request_approval_setting.rb
+++ b/ee/lib/api/entities/merge_request_approval_setting.rb
@@ -9,6 +9,7 @@ class MergeRequestApprovalSetting < Grape::Entity
       expose :retain_approvals_on_push, documentation: { type: 'boolean', example: true }
       expose :selective_code_owner_removals, documentation: { type: 'boolean', example: true }
       expose :require_password_to_approve, documentation: { type: 'boolean', example: true }
+      expose :require_saml_auth_to_approve, documentation: { type: 'boolean', example: true }
     end
   end
 end
diff --git a/ee/lib/api/merge_request_approval_settings.rb b/ee/lib/api/merge_request_approval_settings.rb
index 80541748fe6167ab3c5c9a1e460d1f8b40283f49..edce897eb8545ea337eb239aeb550c35db54490b 100644
--- a/ee/lib/api/merge_request_approval_settings.rb
+++ b/ee/lib/api/merge_request_approval_settings.rb
@@ -18,13 +18,16 @@ class MergeRequestApprovalSettings < ::API::Base
         optional :selective_code_owner_removals, type: Boolean, desc: 'Reset approvals from Code Owners if their files changed', allow_blank: false
         optional :require_password_to_approve,
           type: Boolean, desc: 'Require approver to authenticate before approving', allow_blank: false
+        optional :require_saml_auth_to_approve,
+          type: Boolean, desc: 'Require approver to re-authenticate with SAML before approving', allow_blank: false
 
         at_least_one_of :allow_author_approval,
           :allow_committer_approval,
           :allow_overrides_to_approver_list_per_merge_request,
           :retain_approvals_on_push,
           :selective_code_owner_removals,
-          :require_password_to_approve
+          :require_password_to_approve,
+          :require_saml_auth_to_approve
       end
     end
 
diff --git a/ee/lib/compliance_management/merge_request_approval_settings/resolver.rb b/ee/lib/compliance_management/merge_request_approval_settings/resolver.rb
index ad704c994f3013e1a0cb1c8e6fef3b8108519ed2..55622402495a3862d7792592d340319c01de8ad6 100644
--- a/ee/lib/compliance_management/merge_request_approval_settings/resolver.rb
+++ b/ee/lib/compliance_management/merge_request_approval_settings/resolver.rb
@@ -14,7 +14,8 @@ def execute
           allow_overrides_to_approver_list_per_merge_request: allow_overrides_to_approver_list_per_merge_request,
           retain_approvals_on_push: retain_approvals_on_push,
           selective_code_owner_removals: selective_code_owner_removals,
-          require_password_to_approve: require_password_to_approve
+          require_password_to_approve: require_password_to_approve,
+          require_saml_auth_to_approve: require_saml_auth_to_approve
         }
       end
 
@@ -70,6 +71,17 @@ def require_password_to_approve
         )
       end
 
+      def require_saml_auth_to_approve
+        group_value = group_settings&.require_saml_auth_to_approve
+
+        ComplianceManagement::MergeRequestApprovalSettings::Setting.new(
+          value: [group_value].any?,
+          # locked: is always true for projects frontend will manually ovrride it for groups
+          locked: true,
+          inherited_from: :group
+        )
+      end
+
       private
 
       def instance_settings
@@ -77,6 +89,8 @@ def instance_settings
       end
 
       def group_settings
+        return unless @group.is_a? ::Group
+
         @group&.group_merge_request_approval_setting
       end
 
diff --git a/ee/lib/gitlab/auth/group_saml/sso_enforcer.rb b/ee/lib/gitlab/auth/group_saml/sso_enforcer.rb
index 6c6faa54cb264966c8af1b323ade3f861ecd4ba7..4480588a7b0541ecdfd3388afbc7c236c472441b 100644
--- a/ee/lib/gitlab/auth/group_saml/sso_enforcer.rb
+++ b/ee/lib/gitlab/auth/group_saml/sso_enforcer.rb
@@ -7,7 +7,7 @@ class SsoEnforcer
         DEFAULT_SESSION_TIMEOUT = 1.day
 
         class << self
-          def access_restricted?(user:, resource:)
+          def access_restricted?(user:, resource:, session_timeout: DEFAULT_SESSION_TIMEOUT)
             group = resource.is_a?(::Group) ? resource : resource.group
 
             return false unless group
@@ -17,7 +17,7 @@ def access_restricted?(user:, resource:)
             return false unless saml_provider
             return false if user_authorized?(user, resource)
 
-            new(saml_provider, user: user).access_restricted?
+            new(saml_provider, user: user, session_timeout: session_timeout).access_restricted?
           end
 
           # Given an array of groups or subgroups, return an array
@@ -47,11 +47,12 @@ def resource_member?(resource, user)
           end
         end
 
-        attr_reader :saml_provider, :user
+        attr_reader :saml_provider, :user, :session_timeout
 
-        def initialize(saml_provider, user: nil)
+        def initialize(saml_provider, user: nil, session_timeout: DEFAULT_SESSION_TIMEOUT)
           @saml_provider = saml_provider
           @user = user
+          @session_timeout = session_timeout
         end
 
         def update_session
@@ -59,7 +60,7 @@ def update_session
         end
 
         def active_session?
-          SsoState.new(saml_provider.id).active_since?(DEFAULT_SESSION_TIMEOUT.ago)
+          SsoState.new(saml_provider.id).active_since?(session_timeout.ago)
         end
 
         def access_restricted?
diff --git a/ee/spec/features/merge_request/user_approves_with_saml_auth_spec.rb b/ee/spec/features/merge_request/user_approves_with_saml_auth_spec.rb
new file mode 100644
index 0000000000000000000000000000000000000000..b04e18a0b07ab1caba72d67de4bcf60628fd50cd
--- /dev/null
+++ b/ee/spec/features/merge_request/user_approves_with_saml_auth_spec.rb
@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Merge request > User approves with SAML auth', :js, feature_category: :code_review_workflow do
+  let_it_be(:user) { create :user }
+  let_it_be(:group) { create :group }
+  let_it_be(:setting) do
+    create :group_merge_request_approval_setting,
+      require_saml_auth_to_approve: true,
+      require_password_to_approve: true, # enable password to spec SAML takes precdence over it
+      group: group
+  end
+
+  let_it_be(:project) do
+    create :project,
+      :public,
+      :repository,
+      group: group,
+      approvals_before_merge: 1,
+      merge_requests_author_approval: true
+  end
+
+  let_it_be(:owner) { project.first_owner }
+  let_it_be(:merge_request) { create :merge_request_with_diffs, source_project: project, reviewers: [user] }
+
+  # This emulates a successful response by the SAML provider
+  around do |example|
+    with_omniauth_full_host { example.run }
+  end
+
+  before_all do
+    group.add_developer(user)
+    project.add_maintainer(user)
+  end
+
+  before do
+    stub_default_url_options(protocol: "https")
+    stub_licensed_features(group_saml: true)
+    create(:saml_provider, group: group, enabled: true)
+    mock_group_saml(uid: '1')
+  end
+
+  def sign_in_and_connect_saml_identity
+    # new users have to link their account to their SAML identiiy provider first
+    sign_in(user)
+    visit sso_group_saml_providers_path group_id: group, token: group.saml_discovery_token
+    wait_for_requests
+    page.within('.login-box') { click_link 'Authorize' }
+    wait_for_requests
+  end
+
+  def approve_with_saml
+    visit project_merge_request_path(project, merge_request)
+    page.within('.js-mr-approvals') { click_button 'Approve with SAML' }
+  end
+
+  def revoke_approval
+    click_button 'Revoke approval'
+    wait_for_requests
+  end
+
+  it 'shows user can approve and unapprove' do
+    sign_in_and_connect_saml_identity
+
+    # approval
+    approve_with_saml
+
+    expect(page).to have_text('Approved')
+
+    page.within('.js-mr-approvals') do
+      expect(page).not_to have_button('Approve with SAML')
+      expect(page).to have_text('Approved by you')
+    end
+
+    # revoke approval
+    revoke_approval
+
+    expect(page).to have_button('Approve with SAML')
+    expect(page).not_to have_text('Approved by')
+
+    # flash message with error when approval fails
+    allow_next_instance_of(::MergeRequests::ApprovalService) do |approval_service|
+      allow(approval_service).to receive(:execute).and_return(nil)
+    end
+    visit saml_approval_namespace_project_merge_request_path(group, project, merge_request)
+
+    approve_with_saml
+    expect(page).to have_text('Approval rejected')
+  end
+end
diff --git a/ee/spec/fixtures/api/schemas/public_api/v4/group_merge_request_approval_settings.json b/ee/spec/fixtures/api/schemas/public_api/v4/group_merge_request_approval_settings.json
index ca30308447fc8b225e1832e60d34e5e603434068..af1b84f1798f6fcec052ad6d775d07cdf326d0d7 100644
--- a/ee/spec/fixtures/api/schemas/public_api/v4/group_merge_request_approval_settings.json
+++ b/ee/spec/fixtures/api/schemas/public_api/v4/group_merge_request_approval_settings.json
@@ -2,34 +2,81 @@
   "type": "object",
   "properties": {
     "allow_author_approval": {
-      "value": { "type": "boolean" },
-      "locked": { "type": "boolean" },
-      "inherited_from": { "type": "string" }
+      "value": {
+        "type": "boolean"
+      },
+      "locked": {
+        "type": "boolean"
+      },
+      "inherited_from": {
+        "type": "string"
+      }
     },
     "allow_committer_approval": {
-      "value": { "type": "boolean" },
-      "locked": { "type": "boolean" },
-      "inherited_from": { "type": "string" }
+      "value": {
+        "type": "boolean"
+      },
+      "locked": {
+        "type": "boolean"
+      },
+      "inherited_from": {
+        "type": "string"
+      }
     },
     "allow_overrides_to_approver_list_per_merge_request": {
-      "value": { "type": "boolean" },
-      "locked": { "type": "boolean" },
-      "inherited_from": { "type": "string" }
+      "value": {
+        "type": "boolean"
+      },
+      "locked": {
+        "type": "boolean"
+      },
+      "inherited_from": {
+        "type": "string"
+      }
     },
     "retain_approvals_on_push": {
-      "value": { "type": "boolean" },
-      "locked": { "type": "boolean" },
-      "inherited_from": { "type": "string" }
+      "value": {
+        "type": "boolean"
+      },
+      "locked": {
+        "type": "boolean"
+      },
+      "inherited_from": {
+        "type": "string"
+      }
     },
     "selective_code_owner_removals": {
-      "value": { "type": "boolean" },
-      "locked": { "type": "boolean" },
-      "inherited_from": { "type": "string" }
+      "value": {
+        "type": "boolean"
+      },
+      "locked": {
+        "type": "boolean"
+      },
+      "inherited_from": {
+        "type": "string"
+      }
     },
     "require_password_to_approve": {
-      "value": { "type": "boolean" },
-      "locked": { "type": "boolean" },
-      "inherited_from": { "type": "string" }
+      "value": {
+        "type": "boolean"
+      },
+      "locked": {
+        "type": "boolean"
+      },
+      "inherited_from": {
+        "type": "string"
+      }
+    },
+    "require_saml_auth_to_approve": {
+      "value": {
+        "type": "boolean"
+      },
+      "locked": {
+        "type": "boolean"
+      },
+      "inherited_from": {
+        "type": "string"
+      }
     }
   },
   "additionalProperties": false
diff --git a/ee/spec/fixtures/api/schemas/public_api/v4/project_approvers.json b/ee/spec/fixtures/api/schemas/public_api/v4/project_approvers.json
index 3345fbd8906cfa77200a5ebae54d512f25c5b241..83813baf1a681dcd68b69e2e74a4cb8ba892d2be 100644
--- a/ee/spec/fixtures/api/schemas/public_api/v4/project_approvers.json
+++ b/ee/spec/fixtures/api/schemas/public_api/v4/project_approvers.json
@@ -1,25 +1,53 @@
 {
   "type": "object",
   "properties": {
-    "approvals_before_merge": { "type": "integer" },
-    "disable_overriding_approvers_per_merge_request": { "type": ["boolean", "null"] },
-    "reset_approvals_on_push": { "type": "boolean" },
-    "selective_code_owner_removals": { "type": "boolean" },
-    "merge_requests_author_approval": { "type": ["boolean", "null"] },
-    "merge_requests_disable_committers_approval": { "type": ["boolean", "null"] },
-    "require_password_to_approve": { "type": ["boolean", "null"] },
+    "approvals_before_merge": {
+      "type": "integer"
+    },
+    "disable_overriding_approvers_per_merge_request": {
+      "type": [
+        "boolean",
+        "null"
+      ]
+    },
+    "reset_approvals_on_push": {
+      "type": "boolean"
+    },
+    "selective_code_owner_removals": {
+      "type": "boolean"
+    },
+    "merge_requests_author_approval": {
+      "type": [
+        "boolean",
+        "null"
+      ]
+    },
+    "merge_requests_disable_committers_approval": {
+      "type": [
+        "boolean",
+        "null"
+      ]
+    },
+    "require_password_to_approve": {
+      "type": [
+        "boolean",
+        "null"
+      ]
+    },
     "approvers": {
       "type": "array",
       "items": {
         "type": "object",
-        "properties": {}
+        "properties": {
+        }
       }
     },
     "approver_groups": {
       "type": "array",
       "items": {
         "type": "object",
-        "properties": {}
+        "properties": {
+        }
       }
     }
   },
diff --git a/ee/spec/frontend/approvals/components/approval_settings_spec.js b/ee/spec/frontend/approvals/components/approval_settings_spec.js
index dd07d9e6b4382237f8ea418cfb43c055083fd1a0..efb4ff706061cbcb017f0b37daae206ee46cf7ab 100644
--- a/ee/spec/frontend/approvals/components/approval_settings_spec.js
+++ b/ee/spec/frontend/approvals/components/approval_settings_spec.js
@@ -41,6 +41,7 @@ describe('ApprovalSettings', () => {
 
     store = createStore({ approvalSettings: module, approvals: projectSettingsModule() });
     store.state.settings.groupName = groupName;
+    store.state.settings.samlProviderEnabled = true;
   };
 
   const showToast = jest.fn();
diff --git a/ee/spec/frontend/approvals/stores/modules/approval_settings/getters_spec.js b/ee/spec/frontend/approvals/stores/modules/approval_settings/getters_spec.js
index f2bfaa10f1718be6ad796dec3eb17333d6ee676d..85e6ab9b05b4653aa25c70799977b27a477ce7f5 100644
--- a/ee/spec/frontend/approvals/stores/modules/approval_settings/getters_spec.js
+++ b/ee/spec/frontend/approvals/stores/modules/approval_settings/getters_spec.js
@@ -8,6 +8,7 @@ describe('Group settings store getters', () => {
     preventCommittersApproval: { value: true },
     preventMrApprovalRuleEdit: { value: true },
     requireUserPassword: { value: true },
+    requireSamlAuth: { value: true },
     removeApprovalsOnPush: { value: false },
     selectiveCodeOwnerRemovals: { value: false },
   };
diff --git a/ee/spec/frontend/fixtures/merge_requests.rb b/ee/spec/frontend/fixtures/merge_requests.rb
index cbbe50dc0cbccfff26dd30f5e0ce62327abdb644..94532d3114d9902e20c288f25334db2f3277961b 100644
--- a/ee/spec/frontend/fixtures/merge_requests.rb
+++ b/ee/spec/frontend/fixtures/merge_requests.rb
@@ -2,7 +2,13 @@
 
 require 'spec_helper'
 
-RSpec.describe Projects::MergeRequestsController, '(JavaScript fixtures in EE context)', type: :controller do
+RSpec
+  .describe(
+    Projects::MergeRequestsController,
+    '(JavaScript fixtures in EE context)',
+    type: :controller,
+    feature_category: :code_review_workflow
+  ) do
   include JavaScriptFixturesHelpers
 
   let(:project) { create(:project, :repository, path: 'merge-requests-project') }
diff --git a/ee/spec/frontend/vue_merge_request_widget/mock_data.js b/ee/spec/frontend/vue_merge_request_widget/mock_data.js
index bfcced11415d118eafb56f85ed5870919add22ec..926791180023745036b47cba0348d6a60e283e5a 100644
--- a/ee/spec/frontend/vue_merge_request_widget/mock_data.js
+++ b/ee/spec/frontend/vue_merge_request_widget/mock_data.js
@@ -18,6 +18,7 @@ export default {
   dast_comparison_path: '/dast_comparison_path',
   coverage_fuzzing_comparison_path: '/coverage_fuzzing_comparison_path',
   api_fuzzing_comparison_path: '/api_fuzzing_comparison_path',
+  saml_approval_path: '/group/saml_sso_path',
 };
 
 // Browser Performance Testing
diff --git a/ee/spec/frontend/vue_merge_request_widget/stores/mr_widget_store_spec.js b/ee/spec/frontend/vue_merge_request_widget/stores/mr_widget_store_spec.js
index ae3bdb7c95f30999e544c4720c4804338bd240e6..bdcef9b77b6d9caab8e700fe1495f06f6fb2db4e 100644
--- a/ee/spec/frontend/vue_merge_request_widget/stores/mr_widget_store_spec.js
+++ b/ee/spec/frontend/vue_merge_request_widget/stores/mr_widget_store_spec.js
@@ -83,6 +83,7 @@ describe('MergeRequestStore', () => {
       'secret_detection_comparison_path',
       'api_fuzzing_comparison_path',
       'coverage_fuzzing_comparison_path',
+      'saml_approval_path',
     ])('should set %s path', (property) => {
       // Ensure something is set in the mock data
       expect(property in mockData).toBe(true);
diff --git a/ee/spec/helpers/groups/sso_helper_spec.rb b/ee/spec/helpers/groups/sso_helper_spec.rb
index 4ab0bc472affd90a95c96911eb638acedb16743c..6f416d74145bb0f2cd2fd53ecc4443d20c7d47d5 100644
--- a/ee/spec/helpers/groups/sso_helper_spec.rb
+++ b/ee/spec/helpers/groups/sso_helper_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe Groups::SsoHelper do
+RSpec.describe Groups::SsoHelper, feature_category: :shared do
   describe '#authorize_gma_conversion_confirm_modal_data' do
     let_it_be(:group_name) { 'Foo bar' }
     let_it_be(:phrase) { 'gma_user' }
@@ -20,4 +20,36 @@
       })
     end
   end
+
+  describe '#saml_provider_enabled' do
+    using RSpec::Parameterized::TableSyntax
+    context 'without group' do
+      it 'returns false' do
+        expect(helper.saml_provider_enabled?(nil)).to be false
+        expect(helper.saml_provider_enabled?(build(:user_namespace))).to be false
+        expect(helper.saml_provider_enabled?(build(:project))).to be false
+      end
+    end
+
+    context 'with group' do
+      where(:enabled, :result) do
+        true  | true
+        false | false
+      end
+
+      with_them do
+        it 'returns the expected value' do
+          provider = instance_double('SamlProvider')
+          allow(provider).to receive(:enabled?) { enabled }
+
+          group = instance_double('Group')
+          allow(group).to receive(:is_a?).and_return(true)
+          allow(group).to receive(:root_ancestor) { group }
+          allow(group).to receive(:saml_provider) { provider }
+
+          expect(helper.saml_provider_enabled?(group)).to eq(result)
+        end
+      end
+    end
+  end
 end
diff --git a/ee/spec/helpers/projects_helper_spec.rb b/ee/spec/helpers/projects_helper_spec.rb
index e127ecae24858438c33bfc9e7f13a373402640c4..f2b0e5b5e56924c5185a946ffb54e3b3d2b57e84 100644
--- a/ee/spec/helpers/projects_helper_spec.rb
+++ b/ee/spec/helpers/projects_helper_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe ProjectsHelper do
+RSpec.describe ProjectsHelper, feature_category: :shared do
   include ::EE::GeoHelpers
 
   let_it_be_with_refind(:project) { create(:project) }
@@ -548,6 +548,7 @@
     before do
       allow(helper).to receive(:current_user).and_return(user)
       allow(helper).to receive(:can?).and_return(true)
+      allow(helper).to receive(:saml_provider_enabled_for_project?).and_return(true)
     end
 
     it 'returns the correct data' do
@@ -556,6 +557,7 @@
         can_edit: 'true',
         can_modify_author_settings: 'true',
         can_modify_commiter_settings: 'true',
+        saml_provider_enabled: 'true',
         approvals_path: expose_path(api_v4_projects_merge_request_approval_setting_path(id: project.id)),
         project_path: expose_path(api_v4_projects_path(id: project.id)),
         rules_path: expose_path(api_v4_projects_approval_rules_path(id: project.id)),
diff --git a/ee/spec/lib/api/entities/merge_request_approval_setting_spec.rb b/ee/spec/lib/api/entities/merge_request_approval_setting_spec.rb
index 76c4e0e3e0ec825d039c46e8e1de9c3174f168a5..73abac1179d4473c6046dbfad47bbbdef8557086 100644
--- a/ee/spec/lib/api/entities/merge_request_approval_setting_spec.rb
+++ b/ee/spec/lib/api/entities/merge_request_approval_setting_spec.rb
@@ -15,7 +15,8 @@
         :allow_overrides_to_approver_list_per_merge_request,
         :retain_approvals_on_push,
         :selective_code_owner_removals,
-        :require_password_to_approve
+        :require_password_to_approve,
+        :require_saml_auth_to_approve
       ]
     )
   end
diff --git a/ee/spec/lib/audit/group_merge_request_approval_setting_changes_auditor_spec.rb b/ee/spec/lib/audit/group_merge_request_approval_setting_changes_auditor_spec.rb
index 5bc5e488148cf55c8108c6ca33853cc61de447ba..15eb0bcbeea74c523cbb513b1246cc897b5f04c4 100644
--- a/ee/spec/lib/audit/group_merge_request_approval_setting_changes_auditor_spec.rb
+++ b/ee/spec/lib/audit/group_merge_request_approval_setting_changes_auditor_spec.rb
@@ -39,6 +39,7 @@
              allow_committer_approval: false,
              allow_overrides_to_approver_list_per_merge_request: false,
              retain_approvals_on_push: false,
+             require_saml_auth_to_approve: false,
              require_password_to_approve: false)
     end
 
diff --git a/ee/spec/lib/compliance_management/merge_request_approval_settings/resolver_spec.rb b/ee/spec/lib/compliance_management/merge_request_approval_settings/resolver_spec.rb
index 2bb96225212d67403ddd5ae14cecadc97f98c7e3..725317af0a89b3effe2d349c080824fa34bcb952 100644
--- a/ee/spec/lib/compliance_management/merge_request_approval_settings/resolver_spec.rb
+++ b/ee/spec/lib/compliance_management/merge_request_approval_settings/resolver_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe ::ComplianceManagement::MergeRequestApprovalSettings::Resolver do
+RSpec.describe ::ComplianceManagement::MergeRequestApprovalSettings::Resolver, feature_category: :compliance_management do
   using RSpec::Parameterized::TableSyntax
 
   let_it_be(:group) { create(:group) }
diff --git a/ee/spec/lib/gitlab/auth/group_saml/sso_enforcer_spec.rb b/ee/spec/lib/gitlab/auth/group_saml/sso_enforcer_spec.rb
index f8b2a018307a7d10af298509ead1a380f6ad0602..984598649bfe212f2097dcb76a501fb43f019616 100644
--- a/ee/spec/lib/gitlab/auth/group_saml/sso_enforcer_spec.rb
+++ b/ee/spec/lib/gitlab/auth/group_saml/sso_enforcer_spec.rb
@@ -50,6 +50,24 @@
         expect(subject).not_to be_active_session
       end
     end
+
+    context 'when a session timeout is specified' do
+      subject(:enforcer) { described_class.new(saml_provider, user: user, session_timeout: 1.hour) }
+
+      it 'returns true within timeout' do
+        enforcer.update_session
+
+        expect(enforcer).to be_active_session
+      end
+
+      it 'returns false after timeout elapses' do
+        enforcer.update_session
+
+        travel_to(2.hours.from_now) do
+          expect(enforcer).not_to be_active_session
+        end
+      end
+    end
   end
 
   describe '#access_restricted?' do
@@ -61,12 +79,32 @@
       end
 
       context 'when there is active saml session' do
-        before do
-          subject.update_session
+        context 'when the session timeout is the default' do
+          before do
+            subject.update_session
+          end
+
+          it 'returns false' do
+            expect(subject).not_to be_access_restricted
+          end
         end
 
-        it 'returns false' do
-          expect(subject).not_to be_access_restricted
+        context 'when a session timeout is specified' do
+          subject(:enforcer) { described_class.new(saml_provider, user: user, session_timeout: 1.hour) }
+
+          it 'returns true within timeout' do
+            enforcer.update_session
+
+            expect(enforcer).not_to be_access_restricted
+          end
+
+          it 'returns false after timeout elapses' do
+            enforcer.update_session
+
+            travel_to(2.hours.from_now) do
+              expect(enforcer).to be_access_restricted
+            end
+          end
         end
       end
 
diff --git a/ee/spec/models/group_merge_request_approval_setting_spec.rb b/ee/spec/models/group_merge_request_approval_setting_spec.rb
index 97c9fb3f3d334606bf506f9527a051e9a299a2f2..bfe3edc514084b27dbe2542a7b3b86714cb4291f 100644
--- a/ee/spec/models/group_merge_request_approval_setting_spec.rb
+++ b/ee/spec/models/group_merge_request_approval_setting_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe GroupMergeRequestApprovalSetting do
+RSpec.describe GroupMergeRequestApprovalSetting, feature_category: :compliance_managment do
   describe 'Associations' do
     it { is_expected.to belong_to :group }
   end
diff --git a/ee/spec/requests/api/merge_request_approval_settings_spec.rb b/ee/spec/requests/api/merge_request_approval_settings_spec.rb
index e2af870fef229703535ba446d0764fb371d84de4..496c8ccd0f257d5ca4a341f2ee11df7bdb38901b 100644
--- a/ee/spec/requests/api/merge_request_approval_settings_spec.rb
+++ b/ee/spec/requests/api/merge_request_approval_settings_spec.rb
@@ -95,6 +95,7 @@
           expect(json_response['retain_approvals_on_push']['value']).to eq(true)
           expect(json_response['selective_code_owner_removals']['value']).to eq(false)
           expect(json_response['require_password_to_approve']['value']).to eq(false)
+          expect(json_response['require_saml_auth_to_approve']['value']).to eq(false)
         end
       end
 
diff --git a/ee/spec/serializers/merge_request_widget_entity_spec.rb b/ee/spec/serializers/merge_request_widget_entity_spec.rb
index a9bc34a8d1939fd431dc8cf793d0756af5391cc5..9e9f0e4132796913e05815a535ba39f7df62d9cb 100644
--- a/ee/spec/serializers/merge_request_widget_entity_spec.rb
+++ b/ee/spec/serializers/merge_request_widget_entity_spec.rb
@@ -289,4 +289,12 @@ def create_all_artifacts
 
     expect(subject.as_json).to include(:pipeline_id)
   end
+
+  it 'exposes saml_approval_path', :request_store do
+    expect(subject.as_json).to include(:saml_approval_path)
+  end
+
+  it 'exposes require_saml_auth_to_approve' do
+    expect(subject.as_json).to include(:require_saml_auth_to_approve)
+  end
 end
diff --git a/ee/spec/services/merge_requests/approval_service_spec.rb b/ee/spec/services/merge_requests/approval_service_spec.rb
index ce64c664efae9469b2d4db6767d94638a8eaf5d2..352385ae5a4d2ba4465a106d568c66a0fd5ba108 100644
--- a/ee/spec/services/merge_requests/approval_service_spec.rb
+++ b/ee/spec/services/merge_requests/approval_service_spec.rb
@@ -4,17 +4,41 @@
 
 RSpec.describe MergeRequests::ApprovalService, feature_category: :code_review_workflow do
   describe '#execute' do
-    let(:user)          { create(:user) }
-    let(:merge_request) { create(:merge_request) }
-    let(:project)       { merge_request.project }
-    let!(:todo)         { create(:todo, user: user, project: project, target: merge_request) }
+    let_it_be(:user) { create :user }
+    let_it_be(:group) { create :group }
+    let_it_be(:project) do
+      create :project,
+        :public,
+        :repository,
+        group: group,
+        approvals_before_merge: 0,
+        merge_requests_author_approval: true
+    end
+
+    let_it_be(:merge_request) { create :merge_request_with_diffs, source_project: project, reviewers: [user] }
+    let(:enforced_sso) { false }
 
     subject(:service) { described_class.new(project: project, current_user: user) }
 
     before do
+      stub_licensed_features(group_saml: true)
+      create(:saml_provider, group: project.group, enforced_sso: enforced_sso, enabled: true)
+    end
+
+    before_all do
       project.add_developer(user)
     end
 
+    def simulate_require_saml_auth_to_approve_mr_approval_setting(restricted: true)
+      allow(::Gitlab::Auth::GroupSaml::SsoEnforcer).to(receive(:access_restricted?).and_return(restricted))
+    end
+
+    def simulate_saml_approval_in_time?(in_time:)
+      allow_next_instance_of(::Gitlab::Auth::GroupSaml::SsoState) do |state|
+        allow(state).to receive(:active_since?).and_return(in_time)
+      end
+    end
+
     context 'with invalid approval' do
       before do
         allow(merge_request.approvals).to receive(:new).and_return(double(save: false))
@@ -39,6 +63,7 @@
       before do
         project.update!(require_password_to_approve: true)
       end
+
       context 'when password not specified' do
         it 'does not update the approvals' do
           expect { service.execute(merge_request) }.not_to change { merge_request.approvals.size }
@@ -67,6 +92,18 @@
 
           expect { service_with_params.execute(merge_request) }.to change { merge_request.approvals.size }
         end
+
+        context 'when SAML auth is required' do
+          let(:enforced_sso) { true }
+
+          it 'does not change approval count' do
+            simulate_require_saml_auth_to_approve_mr_approval_setting
+
+            service_with_params = described_class.new(project: project, current_user: user, params: params)
+
+            expect { service_with_params.execute(merge_request) }.not_to change { merge_request.approvals.size }
+          end
+        end
       end
     end
   end
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 38cadff29e011934377536ace626286ce554ba34..0abe6002bf5c4df2b5d73682f3b167bbbe618810 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -6094,6 +6094,9 @@ msgstr ""
 msgid "Approval options"
 msgstr ""
 
+msgid "Approval rejected."
+msgstr ""
+
 msgid "Approval rules"
 msgstr ""
 
@@ -6255,7 +6258,7 @@ msgstr ""
 msgid "ApprovalSettings|Remove approvals by Code Owners if their files changed"
 msgstr ""
 
-msgid "ApprovalSettings|Require user password to approve"
+msgid "ApprovalSettings|Require user re-authentication (password or SAML) to approve"
 msgstr ""
 
 msgid "ApprovalSettings|There was an error loading merge request approval settings."
@@ -57497,6 +57500,12 @@ msgstr ""
 msgid "mrWidget|Approve additionally"
 msgstr ""
 
+msgid "mrWidget|Approve additionally with SAML"
+msgstr ""
+
+msgid "mrWidget|Approve with SAML"
+msgstr ""
+
 msgid "mrWidget|Approved by"
 msgstr ""
 
diff --git a/spec/frontend/fixtures/merge_requests.rb b/spec/frontend/fixtures/merge_requests.rb
index a1896a6470b75225b8fe17baf2095245f7216020..e8272a1f93a529b653bd2c53305ea63a9e01a4f5 100644
--- a/spec/frontend/fixtures/merge_requests.rb
+++ b/spec/frontend/fixtures/merge_requests.rb
@@ -2,7 +2,13 @@
 
 require 'spec_helper'
 
-RSpec.describe Projects::MergeRequestsController, '(JavaScript fixtures)', type: :controller do
+RSpec
+  .describe(
+    Projects::MergeRequestsController,
+    '(JavaScript fixtures)',
+    type: :controller,
+    feature_category: :code_review_workflow
+  ) do
   include JavaScriptFixturesHelpers
 
   let(:namespace) { create(:namespace, name: 'frontend-fixtures') }
diff --git a/spec/frontend/vue_merge_request_widget/components/approvals/approvals_spec.js b/spec/frontend/vue_merge_request_widget/components/approvals/approvals_spec.js
index 2aed037be6f0fd659a74f44abd6090f88a04bb8b..c81f4328d2a14f1b2f113eaae97ba9429dac4012 100644
--- a/spec/frontend/vue_merge_request_widget/components/approvals/approvals_spec.js
+++ b/spec/frontend/vue_merge_request_widget/components/approvals/approvals_spec.js
@@ -4,6 +4,7 @@ import { GlButton, GlSprintf } from '@gitlab/ui';
 import { shallowMount } from '@vue/test-utils';
 import { createMockSubscription as createMockApolloSubscription } from 'mock-apollo-client';
 import approvedByCurrentUser from 'test_fixtures/graphql/merge_requests/approvals/approvals.query.graphql.json';
+import { visitUrl } from '~/lib/utils/url_utility';
 import createMockApollo from 'helpers/mock_apollo_helper';
 import waitForPromises from 'helpers/wait_for_promises';
 import { getIdFromGraphQLId } from '~/graphql_shared/utils';
@@ -28,6 +29,10 @@ jest.mock('~/alert', () => ({
     dismiss: mockAlertDismiss,
   })),
 }));
+jest.mock('~/lib/utils/url_utility', () => ({
+  ...jest.requireActual('~/lib/utils/url_utility'),
+  visitUrl: jest.fn(),
+}));
 
 const TEST_HELP_PATH = 'help/path';
 const testApprovedBy = () => [1, 7, 10].map((id) => ({ id }));
@@ -113,6 +118,7 @@ describe('MRWidget approvals', () => {
       targetProjectFullPath: 'gitlab-org/gitlab',
       id: 1,
       iid: '1',
+      requireSamlAuthToApprove: false,
     };
 
     jest.spyOn(eventHub, '$emit').mockImplementation(() => {});
@@ -172,6 +178,22 @@ describe('MRWidget approvals', () => {
             category: 'primary',
           });
         });
+
+        describe('with SAML auth requried for approval', () => {
+          beforeEach(async () => {
+            const response = createCanApproveResponse();
+            mr.requireSamlAuthToApprove = true;
+            createComponent({}, { query: response });
+            await waitForPromises();
+          });
+          it('approve action is rendered with correct text', () => {
+            expect(findActionData()).toEqual({
+              variant: 'confirm',
+              text: 'Approve with SAML',
+              category: 'primary',
+            });
+          });
+        });
       });
 
       describe('and MR is approved', () => {
@@ -194,6 +216,25 @@ describe('MRWidget approvals', () => {
           });
         });
 
+        describe('with approvers, with SAML auth requried for approval', () => {
+          beforeEach(async () => {
+            canApproveResponse.data.project.mergeRequest.approvedBy.nodes =
+              approvedByCurrentUser.data.project.mergeRequest.approvedBy.nodes;
+            canApproveResponse.data.project.mergeRequest.approvedBy.nodes[0].id = 69;
+            mr.requireSamlAuthToApprove = true;
+            createComponent({}, { query: canApproveResponse });
+            await waitForPromises();
+          });
+
+          it('approve additionally action is rendered with correct text', () => {
+            expect(findActionData()).toEqual({
+              variant: 'confirm',
+              text: 'Approve additionally with SAML',
+              category: 'secondary',
+            });
+          });
+        });
+
         describe('with approvers', () => {
           beforeEach(async () => {
             canApproveResponse.data.project.mergeRequest.approvedBy.nodes =
@@ -215,6 +256,25 @@ describe('MRWidget approvals', () => {
         });
       });
 
+      describe('when SAML auth is required and user clicks Approve with SAML', () => {
+        const fakeGroupSamlPath = '/example_group_saml';
+
+        beforeEach(async () => {
+          mr.requireSamlAuthToApprove = true;
+          mr.samlApprovalPath = fakeGroupSamlPath;
+
+          createComponent({}, { query: createCanApproveResponse() });
+          await waitForPromises();
+        });
+
+        it('redirects the user to the group SAML path', async () => {
+          const action = findAction();
+          action.vm.$emit('click');
+          await nextTick();
+          expect(visitUrl).toHaveBeenCalledWith(fakeGroupSamlPath);
+        });
+      });
+
       describe('when approve action is clicked', () => {
         beforeEach(async () => {
           createComponent({}, { query: canApproveResponse });
diff --git a/spec/requests/api/merge_request_approvals_spec.rb b/spec/requests/api/merge_request_approvals_spec.rb
index df2b20c62c3dd869651d963a741775c1cbfa45ff..2de597502732bc690e48ac13e6858527158a4ebb 100644
--- a/spec/requests/api/merge_request_approvals_spec.rb
+++ b/spec/requests/api/merge_request_approvals_spec.rb
@@ -8,8 +8,6 @@
   let_it_be(:bot) { create(:user, :project_bot) }
   let_it_be(:project) { create(:project, :public, :repository, creator: user, namespace: user.namespace) }
   let_it_be(:approver) { create :user }
-  let_it_be(:group) { create :group }
-
   let(:merge_request) { create(:merge_request, :simple, author: user, source_project: project) }
 
   describe 'GET :id/merge_requests/:merge_request_iid/approvals' do