> thanks Fiona. Eduserve were going to send me details of how they generate
> a persistent ID from EPTI, which they then give to the resources behind
> the gateway. If the value is different for each resource 

Observing the behaviour using the Shibboleth to Athens gateway from
our IdP, the same Athens Persistent User ID (PUID) is presented to
different Athens resources for the same gateway user, which is what
I'd expect.

> then there's a
> chance we can "migrate" the settings from Athens to the fed by
> implementing those rules against our EPTI for those providers who have
> settings "locked-in".

I don't see how this could work just by changing things at your end;
you'd have to clarify that after you get your information from
Eduserv.  But consider this first...

> It's still at the hand waving stage but AFAIK the resources, such as
> Digimap, key settings against the munged value of EPTI they get from the
> gateway. 

The PUID is not so much a munged ePTI as an arbitrary value in
a database at Athens that is looked up based on your ePTI values.

For an Athens login, which is what the Shibboleth to Athens gateway
does, the PUID is what the resource sees.  The ePTI is lost (not
passed along) but even if it were, in the general case the Athens
resource is going to be existing code that wouldn't understand or be
interested in it anyway.

> Theorising for a moment, that would suggest that if we gave
> Digimap the same value of EPTI when accesing it via the fed, then the
> settings will still be accessible.

For a direct federated login, the Digimap SP sees the value of ePTI
that your IdP releases to it.  Since it is a different SP from the
gateway SP, it should see a different targeted id value even if the
underlying ePTI were visible in the Athens case, which it isn't
(without modifying the gateway).

> All we need are the munging rules,
> which we can then implement in our IdP. It might work, it might be pie in
> the sky(e) but I'm waiting to get the details of the munging rules.
>
> Hopefully it'll all come out in the wash.

I'm not hopeful of this, for the reasons set out above.  Something
along those lines might conceivably be made to (sort of) work
_iff_ you were able to modify the IdP code, the gateway code and
the code at all DSP & SPs of interest to fit, which doesn't seem
likely.

Fiona.