Open IDC Client config for App A uses default username/password authentication  OPENID CONNECT CLIENTS DETAILS ------------------------------ - **Name:** app a - **Client ID:** @!XXXX.XXXX.XXXX.XXXX!XXXX!XXXX.XXXX!XXXX!XXXX.XXXX.XXXX.XXXX - **Subject Type:** public - **Expirattion date:** Mon Sep 25 00:00:00 UTC 2119 - **ClientSecret:** XXXXXXXXXXX - **Application Type:** web - **Persist Client Authorizations:** true - **Pre-Authorization:** true - **Authentication method for the Token Endpoint:** client_secret_basic - **Logout Session Required:** false - **Include Claims In Id Token:** false - **Disabled:** false - **Logout Uri:** [https://app-a-review.example.net/callback?logout=get, https://app-a.example.net/callback?logout=get, https://app-a-staging.example.net/callback?logout=get] - **Logout Redirect URIs:** [http://localhost:8080/goodbye.html, https://app-a-review.example.net/goodbye.html, http://app-a-review.example.net/goodbye.html] - **Scopes:** [email, openid, profile, user_name] - **Grant types:** [authorization_code] - **Response types:** [code] Open IDC Client config for App B overrides "Default requested Authentication Context Class Reference (ACR) values" to be "otp"  OPENID CONNECT CLIENTS DETAILS ------------------------------ - **Name:** app b - **Client ID:** @!XXX.XXXX.XXXX.XXXX!XXXX!XXXX.XXXX!XXXX!XXXX.XXXX.XXXX.XXXX - **Subject Type:** public - **Expirattion date:** Sat Sep 23 00:00:00 UTC 2119 - **ClientSecret:** XXXXXXXXXXX - **Application Type:** web - **Persist Client Authorizations:** true - **Pre-Authorization:** true - **Authentication method for the Token Endpoint:** client_secret_basic - **Logout Session Required:** false - **Include Claims In Id Token:** false - **Disabled:** false - **Login Redirect URIs:** [http://app-b.example.net/] - **Scopes:** [email, openid, profile, memberOf] - **Grant types:** [authorization_code] - **Response types:** [code] - **DefaultAcrValues:** [Ljava.lang.String;@4bd4c9ff User logs into App A, and successfully authenticates with just their username and password. When user then logs into App B, the user is allowed in without a prompt for their OTP. I would like the user to have to perform OTP authentication for App B if they haven't yet done so. Is this possible?