I can't speak to Sun Access Manager, but we have noticed similar behavior with Windows Active Directory login module.
Like you, we have them both set to sufficient with Windows as the first check. We did this because IDM did not have a complete password history for the users (Password Sync is just now being deployed).
When the Windows Adapter has a chronic problem (e.g. AD Gateway service goes wonky or the resource password is out of sync) then nobody can get in. Users attempt to login, but it never completes
My best guess for this behavior is that the login module is catching a run time exception and is not progressing to the next login option.
I'd recommend moving IDM to be first, especially if you're considering it sufficient along with the others.
Jason