I don't think you should set a default - just require presence of the auth_source in the model validators, and then use a migration like this:

<pre>
def self.up
  add_column ...
  if (internal = AuthSourceInternal.first).present?
    Usergroup.update_all(:auth_source_id => internal.id)
  end
end
</pre>

This'll handle migration of existing data.