((IClaimsIdentity)Thread.CurrentPrincipal.Identity).BootstrapToken;

var userToken = ((IClaimsIdentity)Thread.CurrentPrincipal.Identity).BootstrapToken;

var token = GetActAsToken(userToken);

var client = new HttpClient
{
    BaseAddress = _baseAddress
};

client.SetToken("SAML", token.TokenXml.OuterXml);
var response = client.GetAsync("exchange api").Result;
// or attach token to EWS somehow

private SecurityToken GetActAsToken(SecurityToken bootstrapToken)
{
    var factory = new WSTrustChannelFactory(
        new UserNameWSTrustBinding(SecurityMode.TransportWithMessageCredential),
        new EndpointAddress(_stsAddress));
    factory.TrustVersion = TrustVersion.WSTrust13;
 //some "service account" required in order to issue "act as" tokens
    factory.Credentials.UserName.UserName = "middletier";
    factory.Credentials.UserName.Password = "abc!123";

    var rst = new RequestSecurityToken
    {
        AppliesTo = new EndpointAddress(_serviceAddress),

        RequestType = RequestTypes.Issue,
        KeyType = KeyTypes.Symmetric,
        ActAs = new SecurityTokenElement(bootstrapToken)
    };

    var channel = factory.CreateChannel();
    var delegationToken = channel.Issue(rst);

    return delegationToken;
}