How to downgrade acr after step-up authentication in Keycloak?

[odsvc-babii]

Hi everyone,

I’ve successfully implemented step-up authentication in Keycloak using an authentication flow with Condition - Level of Authentication, prompt=login, and acr_values=2 in the request. When an elevated LoA is requested, the user is redirected to the IdP and required to re-authenticate — this part works perfectly.

However, I’m now trying to understand how to downgrade the acr value after the elevation period ends.

✅ What works:
Custom flow correctly evaluates acr_values and routes to the appropriate subflow.

Step-up authentication is triggered with prompt=login.

After successful step-up, the acr claim is included in the token with the elevated value (e.g., acr=2).

🧩 The issue:
Once elevated, the session maintains the high acr value indefinitely, even after the max_age window or a timeout has passed. I would like the session to automatically return to the default (lower) acr, or re-evaluate the LoA condition after a certain time.

❓ Questions:
Is there a built-in way in Keycloak to downgrade the acr after some time or event?

Can I invalidate the elevated acr or trigger re-authentication for specific endpoints or clients?

Would using a custom authenticator with session notes (e.g., acr_elevated_at) be the best approach?

Are there any examples or best practices for managing temporary elevation of LoA and restoring it?

Thanks in advance for any guidance or tips! 🙏
Happy to contribute back any working solution.