You also learned:

  • Like exclude-attributes used in this tutorial, include-attributes filters which attributes can be returned to the caller. include-attributes works more like opt-in, while exclude-attributes works more like opt-out.
  • Multiple attributes can apply from multiple rules or even policies. They are combined by PingAuthorize to include before exclude.