walt group & account management

At LIG we have a hand-crafted mechanism to create student groups for walt-based hands-on sessions.
Students generate an ssh keypair, then indicate the public key and the group number they wish to belong to in an online form.
A script allows us to update the file /home/walt/authorized_keys on our ssh gateway (delos.imag.fr).
When a registered student connects using ssh walt@delos.imag.fr a new ssh command is automatically run to reach the walt server (milo.imag.fr); on the walt server, for security reasons, the student lands in a docker container. One student group number corresponds to one container, thus all students of a group land in the same container. In this container, the walt command is installed.
To summarize, the student using ssh walt@delos.imag.fr lands in an isolated environment specific to his student group, where he can use the walt command to interact with the platform.

It could be interesting to make this feature available to all walt installations.
The online form might become a web application served by walt-server-httpd (but this means this HTTP server running on walt server would have to be made accessible to the students, which may not be easy).

Start by reviewing the current /home/walt/authorized_keys update flow, the SSH gateway path through delos.imag.fr and milo.imag.fr, and how walt-server-httpd is exposed. Compare these pieces with the Docker container and group-number behavior described in the issue. Done would mean a documented, reusable group and account-management feature available to Walt installations.