I have an Debian 6 x64, python 2.6, Apache 2.2, Mercurial 1.8. Mercurial is accessed over HTTPS, python uses mod_wsgi, Apache performs "Authentication: Basic" with mod_authnz_external.
What I need is to replace user provided Mercurial username. So if user configured username as "J.D.", but logs in with username "john.doe@company.com", I want to see "john.doe@company.com" in Mercurial commit history.
You cannot do that. You cannot change anything on changesets coming into a server, you can only inspect them (with a pretxnchangegroup hook) and reject them if you don't like what you see.
The reason you cannot change anything is that the changeset IDs depend on all the information in the changesets themselves: user name, commit date, commit message, changed files, the changes themselves. If you change anything, then you also change the changeset hashes.
Changing changeset hashes is unfortunate if the changesets have already been pushed to other places — you end up with duplicate changesets since you cannot communicate back to the client that you have changed his changesets.
You may say that it's a mistake if Alice pushes changesets to the server without her real name, but it's actually a feature. With a distributed version control system, it's possible that Alice pulls directly from Bob to review his changes. She may then add more changesets on top of his and push the whole thing to the server. So if you prevent users from pushing anything but their own changesets, then you prevent such direct collaboration.