Hi,
the attached two patches are not strictly related to tokenGroups processing, but it's very easy to reproduce the problem that way. The issue is only confusing DEBUG messages, but it has already cost me several hours in processing logs from an SSSD user, so I think a fix is due, at least for master.
See the patches and the commit messages for more details.