In a non-domain-joined StoreFront server deployment, authentication occurs at the Citrix ADC and not at the Domain Controller or the Delivery Controller. This is because the StoreFront server is not part of the domain, and therefore, it cannot authenticate users directly with domain credentials. Additionally, server groups are not supported in such a deployment because server groups require domain membership to function properly.