Sync data on each login

I modified the patch because the previous one assumes that account mail is the account name and commented the code in the hook.

I'm taking over maintenance for the D7 version. Sorry that it took so long. Are you still around?

I like the patch but still have some comments - partly inspired by reviewing #3046871: Basic role assignment before typing this.

Also, I'll likely insert comments to the effect of the old samlauth_new_user_alter hook being old - and able to completely be replaced by samlauth_synchronize_saml_data_alter invocations.

+++ b/samlauth.module
@@ -403,33 +408,111 @@ function samlauth_associate_saml_id_with_account($saml_id, $account) {
+function samlauth_synchronize_user_attributes_from_saml_data(&$account, $saml_data) {

Objects don't need a &, they are always already 'passed by reference' / not copied, so modifying always modifies the original object.

2 definitions in the api.php too.

+++ b/samlauth.module
@@ -302,9 +302,14 @@ function samlauth_acs() {
+      if (variable_get('samlauth_login_sync', FALSE)) {
+        if ($needs_saving = samlauth_synchronize_user_attributes_from_saml_data($account, $saml_data)) {
+          user_save($account);
+        }
+      }
     }
     else {
     if (variable_get('samlauth_map_users_email', FALSE) && $account = user_load_by_mail($saml_data[$mail_attribute])) {
       samlauth_associate_saml_id_with_account($unique_id, $account);

Do we need to copy the added hunk below above that last line too? (You did it for the samlauth_set_roles_from_saml() call in #3046871, which I agree with.)
I guess "above" if we realize that exceptions thrown in the alter hook result in dened login.

Added to that:

• I have the feeling (also looking at #3046871) that the code is going to evolve to be better readable in the long run, if that first if() gets moved inside samlauth_synchronize_user_attributes_from_saml_data() (where it becomes if ($is_new || variable_get('samlauth_login_sync', FALSE)) {)
• except for the samlauth_synchronize_saml_data_alter hook. What if we just always call that - regardless of the 'samlauth_login_sync' variable? Does that make things more easily extensible?