The IdP works out what information it is willing to release, based on what it has available, who the user is, and who the SP is. It sends this information back to the SP in a SOAP message encapsulating a SAML Attribute Assertion.
