Sorry, missed the 2nd half of the question and I need to clarify a
little. The machine, app pool, etc accounts must use AD in a farm, but
you can use most any source you like for end user authentication,
authorization and profiles. The caveat on non-AD source for users it
that you will need to use Forms Based Authentication in most cases,
which have some limitations on things like integrations with the Office
clients.