Using the following SOGoUserSource allows one to authenticate when a member of the WTF userClass

sogod SOGoUserSources '(
{
CNFieldName = cn;
IDFieldName = uid;
UIDFieldName = uid;
authenticationFilter = "(userClass=''AE'' OR userClass=''AS'' OR userClass=''WTF'')";
baseDN = "ou=People,o=potsdam.edu";
bindAsCurrentUser = YES;
bindFields = (
uid
);
canAuthenticate = YES;
displayName = People;
filter = "(userClass=''AE'' OR userClass=''AS'' OR userClass=''WTF'')";
hostname = "ldap.potsdam.edu";
id = public;
isAddressBook = YES;
port = 389;
}

If we change filter to :

filter = "(userClass=''AE'' OR userClass=''AS'')";

Authentication fails.

According to the documentation filter is used to set a restrict lookup results and authenticationFilter is used to set a filter restriction on authentication.