Attributes that I can set/send in the SSO process

You can add any standard or custom user profile setting to a Lithium SSO token and have it set that user profile field.  The SSO client documentation should tell you how you can add custom user profile fields via the SSO client library you are using (look for the section in the SSO Client Guide that is titled "Sample 3: Pass optional parameters using a hashmap (Java, .NET) or
an array (PHP)").

You can access any user profile field that has been set for a user with one of these calls (the first one only gives you profile fields that start with "custom.", "custom_tokenized.", or "profile."):

http://community.lithium.com/t5/Community-API/bd-p/developers-rest-api?leaf-id=User.profiles.name.profile_name#User.profiles.name.profile_name

http://community.lithium.com/t5/Community-API/bd-p/developers-rest-api?leaf-id=Settings.name.name#Settings.name.name

And this calls can be made to see if a caller is allowed to view a user profile field (coorisponds with the first call above only):

http://community.lithium.com/t5/Community-API/bd-p/developers-rest-api?leaf-id=User.profiles.name.profile_name.allowed#User.profiles.name.profile_name.allowed