Attributes from an External login are passed in in V3 by wrapping them in an IdPAttributePrincipal and adding them a Subject produced by the login servlet/JSP. There are AttributeDefinitions that can pull them back out. Most of the work on V4 that's new is essentially streamlining that, but that's the current answer. -- Scott