Keycloak now supports Authentication Context Class Reference parameter for different Level of Authentication. It means that you can define different level of authentication in a single flow.
When you add external identity providers to your Keycloak Realm, it retrieves tokens from your identity providers, then sends back to your application a new access_token from your Keycloak Realm. What about the original token ?