Per https://opensource.ncsa.illinois.edu/jira/browse/NDS-1005, we still don't know enough to define authentication requirements for Workbench going forward.  We have some reasonable notes in https://opensource.ncsa.illinois.edu/confluence/display/NDS/Workbench+LDAP+OIDC+SSO.

We need to meet again with the CILogon group and if possible with Globus to understand how we can use scopes for groups.  It is also clear that we still need to manage local ACLs, but there are models for mapping users from LDAP or OAuth with local ACLs.