public class Startup
    {
      //...
      //omitted for brevity
      //...
        public void ConfigureServices(IServiceCollection services)
        {
            services.AddDistributedMemoryCache();
            services.AddSession(conf => conf.Cookie.MaxAge = TimeSpan.FromMinutes(30));
            services.AddAuthentication(IISDefaults.AuthenticationScheme).AddIdentityServerAuthentication(JwtBearerDefaults.AuthenticationScheme, options =>
            {
                options.Authority = _configuration.GetValue<string>("IdentityServer");
                options.SupportedTokens = SupportedTokens.Both;
                options.ApiSecret = _configuration.GetValue<string>("ClientSecret");
                options.RequireHttpsMetadata = false;
            });
            services.AddHttpClient(ServiceConsts.ImpersonatedHttpClientName)
                .ConfigurePrimaryHttpMessageHandler(_ =>
                    new SocketsHttpHandler()
                    {
                        UseProxy = false,
                        Credentials = CredentialCache.DefaultCredentials
                    });

            services.Configure<ForwardedHeadersOptions>(options =>
            {
                options.ForwardedHeaders =
                    ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;

                options.KnownNetworks.Clear();
                options.KnownProxies.Clear();
            });
          //...
          //omitted for brevity
          //...
        }
      
       public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }

            app.UseSession();
            
            app.UseAuthentication();
            app.UseAuthorization();
            app.UseForwardedHeaders();
            app.Use(async (context, next) =>
            {
                string ip = context.Connection.RemoteIpAddress.ToString();
                context.Request.Headers[ForwardedIpToken] = ip;
                await next.Invoke();
            });
            app.UseMiddleware<WinTokenMiddleware>();
            app.UseOcelot().Wait();
        }

      //...
      //omitted for brevity
      //...
}

   [SupportedOSPlatform("windows")]
    public class WinTokenMiddleware
    {
        private readonly RequestDelegate _next;
        private readonly IConfiguration _configuration;
        private readonly IHttpClientFactory _httpClientFactory;
        private static readonly ILogger Logger = Log.ForContext<WinTokenMiddleware>();
        private const string TokenSessionKey = "AuthToken";

        public WinTokenMiddleware(RequestDelegate next, IConfiguration configuration, IHttpClientFactory httpClientFactory)
        {
            _next = next;
            _configuration = configuration;
            _httpClientFactory = httpClientFactory;
        }

        // ReSharper disable once UnusedMember.Global
        public async Task InvokeAsync(HttpContext context)
        {
           //...
           //... omitted for brevity
           //...
                AuthenticateResult winAuthenticateResult = await context.AuthenticateAsync(IISServerDefaults.AuthenticationScheme);
                if (!winAuthenticateResult.Succeeded)
                {
                    await context.ChallengeAsync(IISDefaults.AuthenticationScheme);
                    return;
                }

                if (!(winAuthenticateResult?.Principal?.Identity is WindowsIdentity windowsIdentity))
                {
                    Logger.Warning("Couldn't get user windows account!'");
                    await WriteErrorResponse(context,
                        "Couldn't get user windows account! Please enable windows authentication on server.");
                    return;
                }
           //...
           //... omitted for brevity
           //...
                TokenResponse tokenResponse = await WindowsIdentity.RunImpersonated(
                        windowsIdentity.AccessToken,
                        () =>
                        {
                            Logger.Debug($"Current user {WindowsIdentity.GetCurrent().Name}");
                            HttpClient impersonatedClient = _httpClientFactory.CreateClient(ServiceConsts.ImpersonatedHttpClientName);

                            //получаем токен под пользователем
                            return impersonatedClient.RequestTokenAsync(new TokenRequest()
                            {
                                Address = disco.TokenEndpoint,

                                ClientId = _configuration.GetValue<string>("ClientId"),
                                ClientSecret = _configuration.GetValue<string>("ClientSecret"),
                                GrantType = "windows"

                            });
                        });
//...
//... omitted for brevity
//...
        }
}

            services.AddHttpClient(ServiceConsts.ImpersonatedHttpClientName)
                .ConfigurePrimaryHttpMessageHandler(_ =>
                    new SocketsHttpHandler()
                    {
                        UseProxy = false,
                        Credentials = CredentialCache.DefaultCredentials,
                        PreAuthenticate = false,
                        PooledConnectionLifetime = TimeSpan.Zero
                    });