A user is added to a SharePoint group. The user can be seen in the group but they do not receive the access the group provides.
In the webservice call where the user account is specified it should follow this format:
For example, if the domain is called, "XYX_NT" and the user name is "SPUser" then it would be:
The above will help you get the right user for claims encoded user names.