Raise SimpleSAML Role update priority in hook to work better with ECA

Problem/Motivation

Hi,
Thank you for the amazing work on this module. We use it daily and it has truly been a lifesaver.

I have been trying to implement the ECA module recently and noticed that when I tried to implement one of the simple models of redirecting a user after they login based on their role, that the action wasn't doing what I wanted it to when there was a role change from the IdP to the SP.

I created a ticket with ECA, describing the issue and they recommended that the best place to make a change would be with the SimpleSAML module. https://www.drupal.org/project/eca/issues/3424181 💬 ECA role evaluation with SAML login Active

Steps to reproduce

1. Setup connection between IdP and SP sites, ensure roles are passed between the sites and that re-evaluating roles each time a user logs in is checked.
2. On the SP, setup a basic model that redirects the user when they login based on their role.
3. Have the user login the first time to create the account and set roles, then logout
4. (I don't think they get properly redirected at this point because they don't have any roles, but haven't tested this particular piece.)
5. Change the user's roles on the IdP and have the user login again
6. Notice that the user is not redirected to the right place, they're redirected to the page their previous role was redirected to
7. Log the user out and login again without making any changes, they'll get redirected correctly each subsequent time because roles are not changing.

Proposed resolution

What I think is happening, and the ECA developer confirmed, is that SimpleSAML's role change event is happening later in the event order and ECA is implementing the redirect before SimpleSAML assigns the new roles. Based on my understanding of ECA and they're deep understanding of the Drupal Events stack, I think they're doing everything correctly and just need some help from SimpleSAML_auth to look for the right things.

@jurgenhaas recommended 2 solutions: 💬 ECA role evaluation with SAML login Active

To resolve that, I see 2 approaches:

• SimpleSAML module implements a new event that they dispatch after they've finished the role sync. Then an ECA integration could be implemented that gets to know about that event and you could use that as your starting event.
• SimpleSAML could raise their priority, so that their hook for the user login gets dispatched first.

Both are on the SimpleSAML module and I could imagine that both are valid and would not only benefit ECA but also other use cases. From what you described, it feels as if the role sync needs to be the first thing to happen in any event. I would have thought it should even be part of the session initialization and not an after login hook.

Thank you for any help on this