code: def restrict(self, ava, sp_entity_id, metadata=None):
          
          if metadata:
              spec = metadata.attribute_requirement(sp_entity_id)
              if spec:
                  return self.filter(ava, sp_entity_id, metadata,
                                     spec["required"], spec["optional"])
  
          return self.filter(ava, sp_entity_id, metadata, [], [])
docs: Identity attribute names are expected to be expressed in
          the local lingo (== friendlyName)
  
          :return: A filtered ava according to the IdPs/AAs rules and
              the list of required/optional attributes according to the SP.
              If the requirements can't be met an exception is raised.