...
Beyond the two special cases noted above, an identity provider is NOT REQUIRED to release any attribute not listed in metadata.
...
Beyond the two special cases noted above, an identity provider is NOT REQUIRED to release any attribute not listed in metadata.