What are the rules for SFTP users?

Question

I have an FTP server that authenticates via an API and has user folders in:

/home/ftpusers/files/<username>

Some users have requested SFTP instead and since I already have processes in place to put files in the user's directory, I figure I can just create accounts for the users.

useradd -g sftpgroup -d /home/ftpusers/files/username/ -s /sbin/nologin username
mkdir -p /home/ftpusers/files/username/.ssh
chown -R username:ftpgroup /home/ftpusers/files/username
chmod -R 770 /home/ftpusers/files/username
echo "ssh-rsa user key" > /home/ftpusers/files/username/.ssh/authorized_keys
chown username:sftpgroup /home/ftpusers/files/username/.ssh
chmod 700 /home/ftpusers/files/username/.ssh
chown username:sftpgroup /home/ftpusers/files/username/.ssh/authorized_keys
chmod 600 /home/ftpusers/files/username/.ssh/authorized_keys

the ftpgroup is so a system account can place files in the user folder the sftpgroup is to lock this user to just SFTP using:

Match Group sftpgroup
ForceCommand internal-sftp
AllowTCPForwarding no
X11Forwarding no

Unfortunately this doesn't work. No useful error, just:

Permission denied (publickey)

It does work fine though if I create a user in a more standard way in the /home/ directory

Any ideas on why? I know chroot has a lot of permission restrictions. Is this something like that?

Added namei output: Sure thing:

namei -l /home/ftpusers/files/jmandel/.ssh
f: /home/ftpusers/files/jmandel/.ssh
dr-xr-xr-x root    root      /
drwxr-xr-x root    root      home
drwxrwx--- ftpuser ftpgroup  ftpusers
drwxrwx--- ftpuser ftpgroup  files
drwxrwx--- jmandel ftpgroup  jmandel
drwx------ jmandel sftpgroup .ssh

Marked answer below has good information in comment thread

Answer 1

Add to your sshd_config file following directive and restart ssh:

AuthorizedKeysFile /home/ftpusers/files/%u/.ssh/authorized_keys .ssh/authorized_keys

This will tell ssh daemon where to look for public keys.

Personally I don't use authorized_keys for a long time, but using instead
AuthorizedKeysCommand where I call my program that looking in sqlite database user's key and send them back for authentication. This way I prevent users/hackers to use their own keys and such configuration don't disclose place where public keys are located.

Answer 2

Is it really

echo "ssh-rsa user key" > /home/ftpusers/files/username/.ssh/authorized_keys

authorized_keys contains the public key of the people allowed to log in as this userid, so it's different for each userid you create. In theory the users generate their own public/private key pair and give you the public key. You can of course generate the pair yourself and give them the private part, but if anything bad happens they can claim it was done by someone else using their private key.