That would work but installations that do not run LDAP won't be able to create Usergroups if they require an LDAP auth_source. Possibly the 'OO way' of doing this is to have a base model for Usergroups, then a customized subclass for Usergoups tied to LDAP, similar to Host and Host::Managed. What do you think?