Impersonation Service Account

Your app is just looking for a user account to run as. You'll probably find that you need to assign some special permissions to the account later in the directions.

If you're domain is operating a 2008 R2 level, then you'll probably want a Managed Service Account. It's more complicated, but it changes it's own password and is generally more secure.

If that's too complicated or you're not at R2 level, then you'll just create a typical User Account in ADUC. Manual password picking and rotation would then be necessary (or not, if you're in one of those environments).

_{Note: Generally when people ask about impersonating accounts it's some sort of kerberized middleware, where passing the service ticket from the client's authentication to a back-end app wouldn't work as the middleware doesn't have the TGT from the client. If that sounds complicated, it is. It's a royal PITA to setup and keep working too.}