I think they're all grammatically okay, but the second two constructions are very unusual. Such a phrase is normally constructed like this in colloquial conversation:
Who are you, really?
Who are you, actually?
These questions would be asked by someone who has suddenly become aware that someone else is not who they previously said they were.
Who exactly are you?
This construction is common involving the word "exactly" specifically. I've seen the other construction used with "exactly" as well. The difference in meaning is slight (and the three sentences could likely be used interchangeably without anyone noticing) but this phrasing suggests more that the speaker is merely confused, not deceived. For instance, a story about the American comic book hero Superman might show him in his civillian identity, lifting a car over his head, at which point an amazed bystander might ask, "Who exactly are you?" The word "exactly" suggests that the speaker had a vague idea of who the person was before, and that needs clarifying. "Really" and "actually" suggest that the person was falsely someone else, since we are now asking for the "real" or "actual" identity of the person.