In chasing around the corners of SAK-11320 I stumbled across an odd piece of behavior.
I was pulling all the Realms for a Site with intent to refresh them. When I refreshed the Realms Section Info started to lose track of Section members. The Realms were reporting the proper membership but SI was reporting empty sets. The catalina log had a helpful message about "needing at least one Student." The CM data had the students, the Realm / Group had the students, what gives?
As I kept eyeballing the Realms in the Realm tool I finally scrolled down to the Roles display. No Roles? huh? We have PlentyOfRoles at Stanford?!
My code pulled the Realm/Groups for the Site via the getAuthzGroups(Criteria, Pager) method. It turns out that the resulting Realm Groups are not fully populated; they are missing the Roles! When the Realm refresher goes out and ... well, refreshes the realm it uses the Roles defined in the Realm as part of the refresh. Since the list accessor wasn't providing Realms/Groups with Roles the refresh was incomplete.
Section Info was looking for the Role of Student - or at least one person with the Role of Student. It didn't care that there were people in there; w/out a role what good are they,eh?
It became necessary to re-query for each Realm returned by the getAuthzGroups call individually. Then saving the Realm refreshed the data from the Provider and kept the Roles.