diff --git a/simplesamlphp_auth.services.yml b/simplesamlphp_auth.services.yml
index 96dca56..2f4459e 100644
--- a/simplesamlphp_auth.services.yml
+++ b/simplesamlphp_auth.services.yml
@@ -8,6 +8,8 @@ services:
   simplesamlphp_auth_event_subscriber:
     class: Drupal\simplesamlphp_auth\EventSubscriber\SimplesamlSubscriber
     arguments: ['@simplesamlphp_auth.manager', '@current_user', '@config.factory', '@logger.channel.simplesamlphp_auth', '@current_route_match']
+    calls:
+      - [setMasquerade, ['@?masquerade']]
     tags:
       - {name: event_subscriber}
   simplesamlphp_auth_externalauth_event_subscriber:
diff --git a/src/EventSubscriber/SimplesamlSubscriber.php b/src/EventSubscriber/SimplesamlSubscriber.php
index b4eff41..8be4027 100644
--- a/src/EventSubscriber/SimplesamlSubscriber.php
+++ b/src/EventSubscriber/SimplesamlSubscriber.php
@@ -6,6 +6,7 @@ use Drupal\Core\Config\ConfigFactoryInterface;
 use Drupal\Core\Session\AccountInterface;
 use Drupal\Core\Routing\RouteMatchInterface;
 use Drupal\Core\Url;
+use Drupal\masquerade\Masquerade;
 use Drupal\simplesamlphp_auth\Service\SimplesamlphpAuthManager;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpKernel\KernelEvents;
@@ -53,6 +54,13 @@ class SimplesamlSubscriber implements EventSubscriberInterface {
    */
   protected $routeMatch;
 
+  /**
+   * The masquerade service, may be null if the module is not enabled.
+   *
+   * @var \Drupal\masquerade\Masquerade|null
+   */
+  protected $masquerade;
+
   /**
    * {@inheritdoc}
    *
@@ -75,6 +83,16 @@ class SimplesamlSubscriber implements EventSubscriberInterface {
     $this->routeMatch = $route_match;
   }
 
+  /**
+   * Sets the masquerade service.
+   *
+   * @param \Drupal\masquerade\Masquerade $masquerade
+   *   The masquerade service.
+   */
+  public function setMasquerade(Masquerade $masquerade) {
+    $this->masquerade = $masquerade;
+  }
+
   /**
    * Logs out user if not SAML authenticated and local logins are disabled.
    *
@@ -94,6 +112,10 @@ class SimplesamlSubscriber implements EventSubscriberInterface {
       return;
     }
 
+    if ($this->masquerade && $this->masquerade->isMasquerading()) {
+      return;
+    }
+
     if ($this->config->get('allow.default_login')) {
 
       $allowed_uids = explode(',', $this->config->get('allow.default_login_users'));