Recommended way to prevent logins based on SAML response

I'm not sure what you need, so here's my response, in the form of a possible first stab in the direction of what you want, so you can maybe specify what goes wrong there.

I'd probably

• Copy UserRolesEventSubscriber into a custom module (rename, add to services.yml)
• Remove basically all the code from onUserSync() except the $account = $event->getAccount(); and ($attributes = )$event->getAttributes() lines
• Build your own code from there.
• EDIT: Throw an exception when finding your forbidden roles, to deny login. (Plain \RuntimeException if you want the users to see just a generic message; UserVisibleException if you want the exception message to be shown to the user.)

Note:

• $attributes['YOUR ATTRIBUTE NAME'] is always an array; that's intrinsic to SAML responses. (The IdP basically sends [VALUE], never VALUE.)
• Bug: Logging a warning/error and throwing an exception does not work, per #3400068-8: Logging errors in SamlauthEvents::USER_SYNC