Symantec Access Management

For one of the federation application we need to send nearly 25 attributes in SAML assertion, I am just wondering, is there any industry standard which defines the maximum no of attributes to be passed through SAML response. I meant to say limits..such as 50 or 100 attributes max.

SAML 2.0 OASIS specification doesnt say (or restrict) the number of attributes in the assertions. Practically if there are many attributes then the assertion size will be huge and it may have issues if you are using HTTP-Redicrect binding.

If all 25 attributes are not required for every authentication, it might make more sense to utilize a SAML Attribute Service.  This way the relying party can generate a SAML Attribute Service request to get the additional user information from the Identity Provider.