Passing Azure AD B2C authenticated credentials through to a secondary system (Keycloak) for re-authentication

We have Azure AD B2C (custom policy, iconazb2cgendev001 tenant) configured as an external OIDC identity provider brokered through Keycloak. Login works correctly end-to-end - users authenticate against B2C and are provisioned into Keycloak via first broker login.

Our downstream application has a separate re-authentication step (an e-signature) that requires validating the user's password directly against Keycloak - either a local Keycloak-stored password or an LDAP-federated one. It does not currently support validating this step against an external OIDC session/token.

Since B2C authenticates the user but never exposes the plaintext password to Keycloak (as expected - this is by design), users authenticated purely through B2C cannot complete this secondary password confirmation step.

Questions:

1. Is there any supported mechanism (ROPC flow, custom B2C policy technical profile, claims-based re-authentication, etc.) that would allow a downstream system to re-verify a user's identity/credentials at a later point in the same session, without needing a locally-stored password?
2. Is there a recommended pattern for handling a "re-authenticate to confirm this action" requirement (similar to step-up authentication) when the primary IdP is Azure AD B2C?

Any guidance on supported approaches (rather than workarounds involving a separate local/LDAP password) would be appreciated.