It depends of your nFactor flow. NS gateway is doing the authentication and then pass-through to Storefront if you have enabled SSO so Storefront is not usually authenticating with AD. Delivery controller is not doing authentication, it checks membership of AD groups to present the correct apps. So not it is one authentication per type if you have SSO.