private bool ImpersonationCheckOnSqlConnection(SqlConnection connection)

    {

      string username = String.Empty;

      string password = String.Empty;

      string domain = String.Empty;

      bool impersonatingAnotherUser = false;

      // If we are using integrated security we may need to impersonate another user

      SqlConnectionStringBuilder builder = new SqlConnectionStringBuilder(connection.ConnectionString);

      if (builder.IntegratedSecurity)

      {

        // Attempt to retrieve the password element

        password = builder.Password;

        // If we have a password element then we are intending to impersonate another user.

        // Otherwise, we are intending running as the current thread identity.

        if (!String.IsNullOrEmpty(password))

        {

          // At this point we no longer need the password in the connection string, so we remove it.

          builder.Password = String.Empty;

          connection.ConnectionString = builder.ConnectionString;

          // Retrieve the user name token from the connection string

          username = builder.UserID;

          // If we have NT user credentials and the current thread is not running under that NT user, then impersonate NT user

          if (!String.IsNullOrEmpty(username) && WindowsIdentity.GetCurrent().Name != username)

          {

            // Retrieve the domain from full user name

            AuthenticationTokenManager.ParseNTCredentials(

              ref username,

              password,

              out domain);

            // Indicate that yes, we are impersonating another user

            impersonatingAnotherUser = true;

          }

          // Else we have a password but we do not have a user name or the process is already running under the NT user identity.

          // In either case do not attempt impersonation, depend on the current thread identity to open the connection.

        }

      }

      // Start impersonating another user

      if (impersonatingAnotherUser)

      {

        impersonatingAnotherUser = ImpersonateValidUser(username, domain, password);

      }

      return impersonatingAnotherUser;

    }

Vera code always throws a flag here (on the impersonation check), and I'm trying to come up with a way to officially mitigate it.

The data for the connection string is coming from a trusted source, and this is an accepted mitigation, but id like to eliminate it from future reports if i can.

THANKS EVERYONE.