Hook to process/alter SAML attributes early?

You should be able to use an EventSubscriber that subscribes to SamlauthEvents::USER_SYNC events, for things like this. See UserSyncEventSubscriber for an example.

(I'm using the word "example" lightly because you'll want to completely re-do onUserSync() (and the constructor/class variables) in your own copy... but it gets you into the direction. I think what you really want to do is not "change the attributes" but if ( ? ) $event->getAccount()->setEmail( ? );

Hm. I see the issue: UserSyncEventSubscriber will throw an exception if the email isn't set in the attribute.

I think (if I understand your use case correctly and this is an issue you are looking to solve for new users only) what should happen is

1) you make your event subscriber and register it with a higher priority as UserSyncEventSubscriber, e.g. (if I'm not mixing up numbers) 75:

classs yourSubscriber
  public static function getSubscribedEvents() {
    $events[SamlauthEvents::USER_SYNC][] = ['onUserSync', 75];
    return $events;
  }

...and set the email in there for new accounts

2) I should fix UserSyncEventSubscriber line 205:

- elseif ($account->isNew()) {
+ elseif ($account->isNew() && !$account->getEmail()) {

Can you test that?

That's slightly surprising to me because it still feels like the UserSyncEventSubscriber should have been fixed. So I just pushed the change anyway.

(I'm a bit late; had the commit locally for a few days.)