title: Usage of SAML attribute AttributeStatement
body: <p>in SAML 2.0 you can use the AttributeStatement element to provide any kind of application specific information. </p>
  
  <p>What I was wondering, is it really good design to pass business related information within a SAML assertion? Shouldn't this data be provided in a e.g. separate web services call?</p>
  
  <p>I just want to ask for best practice in this case or any real world experiences.</p>
  
  <p>Regards,
  Andreas</p>