Well the in_auth_source? needs to be there, as I need to check if the Usergroup is in LDAP or not, but the :if condition can go away.