Keycloak now supports Authentication Context Class Reference parameter for different Level of Authentication. It means that you can define different level of authentication in a single flow.
When you add external identity providers to your Keycloak Realm, it retrieves tokens from your identity providers, then sends back to your application a new access_token from your Keycloak Realm. What about the original token ?
Keycloak generates a session on each user login. Those sessions are replicated in infinispan caches. Sometimes, we only need a token, not a session. This is how to do it.