ECA role evaluation with SAML login

Thanks @rex.barkdoll for the great issue description, this makes the problem straightforward to understand. And your observations are perfect, that's precisely what's happening.

To resolve that, I see 2 approaches:

• SimpleSAML module implements a new event that they dispatch after they've finished the role sync. Then an ECA integration could be implemented that gets to know about that event and you could use that as your starting event.
• SimpleSAML could raise their priority, so that their hook for the user login gets dispatched first.

Both are on the SimpleSAML module and I could imagine that both are valid and would not only benefit ECA but also other use cases. From what you described, it feels as if the role sync needs to be the first thing to happen in any event. I would have thought it should even be part of the session initialization and not an after login hook. Would you mind reporting that with the SimpleSAML maintainers? We could maybe even move this issue over there, then I would stay in the loop and chime in if that was helpful in some way.

Happy to, thank you for confirming my thought process and providing possible solutions :)

This is the ticket I created on their issue queue: https://www.drupal.org/project/simplesamlphp_auth/issues/3424467 ✨ Raise SimpleSAML Role update priority in hook to work better with ECA Active

Nice, thank you. I'm following that other issue now, so if any questions arise, I'll be able to comment there if I can. Setting this one to "Postponed ..." and add the other issue as related.