sshd: error: PAM: User not known to the underlying
authentication module for illegal user
I've occasionally had a similar problem.
The most recent time, it was only ssh that couldn't find the user.
'id user' worked, 'su user' worked, 'kinit user' worked.
Only 'ssh user@host' didn't work.
And then, even 'ssh user@host' worked.
I suspect, but can't prove, that it was an intermittent problem talking to the AD
User's credentials are cached now, so totally not able to troubleshoot further.