Enterprise Sign-On Engine

The current Attribute authority implementation should be overhauled to switch from an "all attributes" mode on AA requests to an "approved attributes" mode on a request.

Approved attributes should be determined based upon the active metadata for the calling SPEP along with any additional restrictions placed in the Attribute request sent by the SPEP. (No attributes in the request means that all attributes allowed for that SPEP should be returned).

NB: If an SPEP requests attributes that are not approved in metadata then they MUST NOT be sent. SP with no attributes in MD gets no attributes for any request.