Is "invalid user" all you're seeing in the log?
Generally, at least with
OpenSSH, if the user is being denied because it's not in a valid group,
the logs will say so. They'll also generally tell you if it's because it
couldn't find the user at all (often with exactly what it did to try to
find the user).
Here's what I'm seeing:
Feb 12 16:02:49 watcher sshd[953]: User scarolan from 10.2.3.102 not
allowed because none of user's groups are listed in AllowGroups
I have UsePAM turned on, and getent group shows me in the "operations"
group. I wonder why sshd is not seeing that I'm in the operations
group?