default Map<String, Object> encodeAttributes(final Map<String, Object> model,
                                                 final Map<String, Object> attributes,
                                                 final RegisteredService registeredService,
                                                 final Service webApplicationService) {
        val finalAttributes = new HashMap<String, Object>(attributes.size());
        attributes.forEach((k, v) -> {
            val attributeName = decodeAttribute(k);
            LOGGER.debug("Decoded attribute [{}] to [{}] with value(s) [{}]", k, attributeName, v);
            finalAttributes.put(attributeName, v);
        });
        return finalAttributes;
    }
Encodes attributes that are ready to be released.
Typically, this method tries to ensure that the
PGT and the credential password are correctly encrypted
before they are released. Attributes should not be filtered
and removed and it is assumed that all will be returned
back to the service.

@param model                 the model object that carries data across the validation protocol
@param attributes            The attribute collection that is ready to be released
@param registeredService     the requesting service for which attributes are to be encoded
@param webApplicationService the web application service
@return collection of attributes after encryption ready for release.
@since 4.1
api/cas-server-core-api-services/src/main/java/org/apereo/cas/authentication/ProtocolAttributeEncoder.java