The Java source code can be found in your project directory under javasource / saml20 / actions. You could add your code there. But do note that upgrading the module to a newer version will also remove your code. So each version upgrade of that module means extra work.
Are you referring to the SAML request or response? For the response the module comes with a microflow which is called something like CustomLoginLogic / customUserProvisioning if I recall correctly. This microflow is called from the request handler within the Java code and is the first place where default Mendix microflow logic can be used if the user is authenticated at the identity provider side. Can’t you add your needed logic there? Or do you need to do something with the SAML request or response before it hits that microflow, hence in Java?