title: OpenID Connect AAD user impersonation
body: <p>I've implemented authentication based on the OpenID Connect sample found <a href="https://github.com/Azure-Samples/active-directory-dotnet-webapp-webapi-openidconnect-aspnetcore" rel="nofollow noreferrer">here</a>. In development environment I'd like to add user impersonation which also works with on behalf of authentication. I want downstream APIs like the Graph API or other services like Azure Analysis Services to use the impersonated user too.</p>
  
  <p>Where can I read up on how to implement this? Is this even possible?</p>