Attribute Authentication in Attribute Based Encryption (ABE) When a data user requires access it asks the key issuer to generate a key for it using the specified attributes.

How does the key issuer authenticate that the data user actually acquires the attributes it claims to possess?
If you take a look at the KP-ABE paper or the first paper proposing the idea of ABE you can see that the set of attributes one claims to have is not authenticated.

In fact there is a setup phase during which one will take the attributes one wants to publicly disclose, and will generate a discrete logarithm public key, so to say, for each of those attributes and a key generation phase during which the same "authority" will generate private keys for each of those attributes.
One can then publish the set of attributes, the "set of attributes' public keys", as well as a randomly chosen integer $y$. And those publicly disclosed keys can then be used to encrypt data for a subset of those attributes, by whoever wishes to do so.

Now, the magic of ABE is that when you decide to encrypt for a given subset of attributes, only the persons owning all of the corresponding attributes' private keys (generated at the key generation phase by the "authority") can then combine this subset of keys in order to decrypt that ciphertext.
The persons who do possess all of these attributes' private keys can then perform the so called decryption phase, which will the bilinear map $e$ used to "stitch together" the plaintext only if the ciphertexts was addressed to the given subset of attributes out of all the attributes' keys one may possess.

However the way one distributes the attributes and their corresponding private keys created during "setup" to individuals for them to perform "key generation", is not taken into account by the scheme itself and should obviously be done in a secure, authenticated way which deals appropriate attributes to each individuals.

So, the "authority" generating the public keys and the private keys must effectively assign the attributes' private keys to the people who "own" those attributes, but the ABE schemes themselves do not take care of this practical aspect of the problem.