@Override
    public Map<String, List<Object>> getAuthenticationAttributesForRelease(final Authentication authentication,
                                                                           final RegisteredService service) {
        if (service == null || !service.getAttributeReleasePolicy().isAuthorizedToReleaseAuthenticationAttributes()) {
            LOGGER.debug("Attribute release policy for service [{}] is configured to never release any authentication attributes", service);
            return new LinkedHashMap<>();
        }

        val attrs = new LinkedHashMap<>(authentication.getAttributes());
        attrs.keySet().removeAll(neverReleaseAttributes);

        if (onlyReleaseAttributes != null && !onlyReleaseAttributes.isEmpty()) {
            attrs.keySet().retainAll(onlyReleaseAttributes);
        }

        if (isAttributeAllowedForRelease(CasProtocolConstants.VALIDATION_CAS_MODEL_ATTRIBUTE_NAME_AUTHENTICATION_DATE)) {
            attrs.put(CasProtocolConstants.VALIDATION_CAS_MODEL_ATTRIBUTE_NAME_AUTHENTICATION_DATE,
                CollectionUtils.wrap(authentication.getAuthenticationDate()));
        }

        decideIfCredentialPasswordShouldBeReleasedAsAttribute(attrs, authentication, service);

        LOGGER.trace("Processed protocol/authentication attributes from the output model to be [{}]", attrs.keySet());
        return attrs;
    }
Default AuthenticationAttributeReleasePolicy implementation.

@author Daniel Frett
@since 5.2.0
core/cas-server-core-authentication-attributes/src/main/java/org/apereo/cas/authentication/DefaultAuthenticationAttributeReleasePolicy.java