@Override
    public Map<String, List<Object>> getAttributesInternal(final RegisteredServiceAttributeReleasePolicyContext context,
                                                           final Map<String, List<Object>> attributes) {
        HttpResponse response = null;
        try (val writer = new StringWriter()) {
            MAPPER.writer(new MinimalPrettyPrinter()).writeValue(writer, attributes);
            headers.put(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE);

            val exec = HttpExecutionRequest.builder()
                .method(HttpMethod.valueOf(this.method))
                .url(SpringExpressionLanguageValueResolver.getInstance().resolve(endpoint))
                .parameters(CollectionUtils.wrap("principal", context.getPrincipal().getId(),
                    "service", context.getRegisteredService().getServiceId()))
                .entity(writer.toString())
                .headers(headers)
                .build();
            response = HttpUtils.execute(exec);
            if (response != null && HttpStatus.resolve(response.getCode()).is2xxSuccessful()) {
                try (val content = ((HttpEntityContainer) response).getEntity().getContent()) {
                    val result = IOUtils.toString(content, StandardCharsets.UTF_8);
                    LOGGER.debug("Policy response received: [{}]", result);
                    val returnedAttributes = MAPPER.readValue(result, new TypeReference<Map<String, List<Object>>>() {
                    });
                    return FunctionUtils.doIf(getAllowedAttributes().isEmpty(),
                                    () -> returnedAttributes,
                                    () -> authorizeMappedAttributes(context, returnedAttributes))
                            .get();
                }
            }
        } catch (final Exception e) {
            LoggingUtils.error(LOGGER, e);
        } finally {
            HttpUtils.close(response);
        }
        return new HashMap<>();
    }
Return a collection of allowed attributes for the principal based on an external REST endpoint.

@author Misagh Moayyed
@since 4.1.0
core/cas-server-core-authentication-attributes/src/main/java/org/apereo/cas/services/ReturnRestfulAttributeReleasePolicy.java