In previous versions SSO didnt like mixing different SSO sources along with nested groups as per the article below. It doesn't explicitly mention 6.5 and doesn't explain why it worked previously but I just did a quick test and seemed to get the same behaviour...
I saw this KB and thought about it and it would seem according to the KB that it shouldn't work but what is puzzling is that somehow it works for one of my VCSA 6.5 and I can't understand how it works for one VCSA and not the other. I literally created and setup both at the same time with exact same steps and the order I did them in.
Did you ever get this resolved? I Would be interested to know as I am experiencing the same issue.