Monitor which attributes (not values) are released per IdP

New Feature Request

Summary

Problem: When communicating with SPs/RPs, the federation operator now cannot tell which attributes are available from the connected IdP's.

Value: This gives the federation operator insight in what attributes are available from which IdP, so attributes can be predicably released to SPs/RPs, according to the attribute release policy. This assumes attributes are filled with valid values, addressing that is a separate problem.

Proposed Solution

• Action: For each authentication, check which attributes (not values) were released by the IdP and compare that against a list of expected attributes for that IdP.

• Design: [Link to Figma/Screenshots]

• Impact: Does this affect existing APIs or UI components?

Developer Checklist

To be completed by the developer during implementation.

• Add required changes and feature flags config files
• Create and document database changes and migrations
• Create and document API changes and migrations
• check for backwards compatibility
• Updated CHANGELOG and other documentation where needed

Testing and QA

Describe how to verify and test this change.

Test Environment and Setup

1. Point to [URL/Branch]
2. Use account with [Role/Permissions]

Test Checklist

• Happy Path: Feature works as intended under normal conditions.
• Edge Case: [Describe specific test item]
• Validation: [Describe specific test item]
• UI/UX: Verified layout across screen sizes.

Extra Information

Add any other context, related issues, or technical notes here.

No implementation files or tests are named. Start by locating the authentication attribute-release flow and the expected-attribute configuration for each IdP; done means exposing which attribute names were released per authentication, comparing them with the expected list, and covering the comparison behavior.