Keeping this in the usergroup model bothers me as there are lots of `auth_source.type` checks, could we move it into the LDAP auth source and have it update the usergroups?