Do you mean the impersonate line in the web.config? If you do then it depends. Some portals work fine without it and some require it. It all depends on the network infrastructure where you're at. If you currently have to use it to get the AD Provider to work then you need to use it. In a future version I want to get rid of that but haven't had time to investigate the ramifications of changing the code. It could end up being one line is all that needs to be change or it could end up being a 100 (I inherited the code and I still find new things a year after taking over the project). The way things are looking for me right now it's going to be the fall before I get time to look at it.

That said, while I understand where your company is coming from (and I agree with them as well) what I've done is use a very limited user account for the impersonation so that even if someone managed to get the username/password they wouldn't be able to do anything with it.