In ASP.NET Core you can implement the IClaimsTransformation interface. This allows you to extend/change the incoming claimsprincipal:
Unfortunately my ClaimsTransformer was never invoked when I used Windows Authentication in IIS.
The trick was to explicitly specify the IISServerDefaults.AuthenticationScheme: