The AbstractIDPValve in the current picketlink-bindings master (as well as 2.7.0.CR2 and CR1) is no longer using the list of custom attributes set in jboss-web.xml, ie, via:

<jboss-web>
  <security-domain>idp-domain</security-domain>
  <context-root>idp</context-root>
  <valve>
  <class-name>org.picketlink.identity.federation.bindings.tomcat.idp.IDPWebBrowserSSOValve</class-name>
	<param>
        <param-name>attributeList</param-name>
        <param-value>my_attribute_1, my_attribute_2</param-value>
     </param>
   </valve>   
</jboss-web>

The listed attribute names are stored in the private attributeKeys member of AbstractIDPValve, but is no longer being used anywhere in the class.

If defined as above, the expectation (from prior versions of 2.7.0) is that if the attributeKeys is defined, they are used and passed into the DelegatedAttributeManager.

Please see the pull request for more info