Comment 2 for bug 1000609

The pam get_tenant will return None if user_ref['id'] were to be None.
The sql get_tenant does : [x.tenant_id for x in membership_refs] which will return None if the tenant_id is None, and nullable=False is not passed to the Column, so AFAICT that is the case. Possibly the membership ref is being update to NULL explicitly. Either way, the code and the schema are mismatched today: the code assumes the row can never be NULL, the schema does not prevent this.
The kvs store returns whatever is listed under tenants, I'd expect it to be much more likely to return stale tenants than None.
The ldap core looks reasonably immune.

Best bet on the data we have so far is the SQL one. Can you confirm you're using the SQL backend ?