OpenConext · kayjoosten · Jul 20, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -11,6 +11,12 @@ More information about our release strategy can be found in
 the [Development Guidelines](https://github.com/OpenConext/OpenConext-engineblock/wiki/Development-Guidelines#release-notes)
 on the EngineBlock wiki.
 
+## Unreleased
+
+Removed:
+
+* Removed the guest_qualifier / isMemberOf guest-status feature (`AddGuestStatus`, `FilterReservedMemberOfValues`). Unused and confirmed safe to remove. (#1294)
+
 ## 7.2.0
 
 Maintenance:

diff --git a/config/packages/parameters.yml.dist b/config/packages/parameters.yml.dist
@@ -144,8 +144,6 @@ parameters:
     engineblock.metadata_push_memory_limit: 256M
     ## Minimum execution time in milliseconds when a received response is deemed invalid (default: 5000 ms)
     minimum_execution_time_on_invalid_received_response: 5000
-    ## The value for guest qualifier. Can be overridden for specific environments
-    addgueststatus_guestqualifier: 'urn:collab:org:dev.openconext.local'
 
     ## Language cookie settings
     ## The value for the domain is also used for clearing SSO Notification cookies if the feature is enabled

diff --git a/docs/filter_commands.md b/docs/filter_commands.md
@@ -79,15 +79,6 @@ Uses:
 Modifies:
 - responseAttributes
 
-### FilterReservedMemberOfValues
-Removes any attributes starting with `urn:collab:org` as these may only be set by EngineBlock
-
-Uses:
-- responseAttributes
-
-Modifies:
-- responseAttributes
-
 ### RunAttributeManipulations (for IdP)
 run possible custom attribute manipulations
 
@@ -148,19 +139,6 @@ Uses:
 Modifies:
 - responseAttributes
 
-### AddGuestStatus
-Add the 'urn:collab:org:surf.nl' value to the isMemberOf attribute in case a user is considered a 'full member' of the
-SURFfederation based on user and configuration
-
-Depends On:
-- Configuration
-
-Uses:
-- OpenConext\EngineBlock\Metadata\Entity\IdentityProvider
-
-Modifies:
-- responseAttributes
-
 ### ProvisionUser
 If a new user is encountered, provision the user in the UserDirectory, generating a CollabPersonId for new users. If
 an existing user is encountered, retrieve the stored CollabPersonId

diff --git a/library/EngineBlock/Application/DiContainer.php b/library/EngineBlock/Application/DiContainer.php
@@ -487,14 +487,6 @@ public function getMfaHelper(): MfaHelperInterface
         return $this->container->get(\OpenConext\EngineBlock\Service\MfaHelper::class);
     }
 
-    /**
-     * @return string
-     */
-    public function getGuestStatusQualifier()
-    {
-        return (string) $this->container->getParameter('addgueststatus_guestqualifier');
-    }
-
     /**
      * @return string
      */

diff --git a/library/EngineBlock/Corto/Filter/Command/AddGuestStatus.php b/library/EngineBlock/Corto/Filter/Command/AddGuestStatus.php
diff --git a/library/EngineBlock/Corto/Filter/Command/FilterReservedMemberOfValues.php b/library/EngineBlock/Corto/Filter/Command/FilterReservedMemberOfValues.php
diff --git a/library/EngineBlock/Corto/Filter/Input.php b/library/EngineBlock/Corto/Filter/Input.php
@@ -57,10 +57,6 @@ public function getCommands()
             // Convert all OID attributes to URN and remove the OID variant
             new EngineBlock_Corto_Filter_Command_NormalizeAttributes(),
 
-            // The IdP is not allowed to set the isMemberOf attribute with urn:collab:org groups
-            // so we make sure to remove them
-            new EngineBlock_Corto_Filter_Command_FilterReservedMemberOfValues(),
-
             // Run custom attribute manipulations
             new EngineBlock_Corto_Filter_Command_RunAttributeManipulations(
                 EngineBlock_Corto_Filter_Command_RunAttributeManipulations::TYPE_IDP
@@ -78,9 +74,6 @@ public function getCommands()
             // Require valid UID and SchacHomeOrganization
             new EngineBlock_Corto_Filter_Command_ValidateRequiredAttributes(),
 
-            // Add guest status (isMemberOf)
-            new EngineBlock_Corto_Filter_Command_AddGuestStatus(),
-
             // Figure out the collabPersonId
             new EngineBlock_Corto_Filter_Command_ProvisionUser(
                 $diContainer->getUserDirectory()

diff --git a/src/OpenConext/EngineBlock/Metadata/Coins.php b/src/OpenConext/EngineBlock/Metadata/Coins.php
@@ -18,7 +18,6 @@
 
 namespace OpenConext\EngineBlock\Metadata;
 
-use OpenConext\EngineBlock\Metadata\Entity\IdentityProvider;
 use RobRichards\XMLSecLibs\XMLSecurityKey;
 
 /**
@@ -68,7 +67,6 @@ public static function createForServiceProvider(
     }
 
     public static function createForIdentityProvider(
-        $guestQualifier,
         $schacHomeOrganization,
         $hidden,
         $stepupConnections,
@@ -81,7 +79,6 @@ public static function createForIdentityProvider(
         ?string $azureDomainHint = null
     ) {
         return new self([
-            'guestQualifier' => $guestQualifier,
             'schacHomeOrganization' => $schacHomeOrganization,
             'hidden' => $hidden,
             'disableScoping' => $disableScoping,
@@ -203,11 +200,6 @@ public function defaultRAC()
         return $this->getValue('defaultRAC');
     }
 
-    public function guestQualifier()
-    {
-        return $this->getValue('guestQualifier', IdentityProvider::GUEST_QUALIFIER_ALL);
-    }
-
     public function schacHomeOrganization()
     {
         return $this->getValue('schacHomeOrganization');

diff --git a/src/OpenConext/EngineBlock/Metadata/Entity/Assembler/PushMetadataAssembler.php b/src/OpenConext/EngineBlock/Metadata/Entity/Assembler/PushMetadataAssembler.php
@@ -252,7 +252,6 @@ private function assembleIdp(stdClass $connection)
         $properties = $this->assembleCommon($connection);
 
         $properties += $this->assembleSingleSignOnServices($connection);
-        $properties += $this->setPathFromObjectString(array($connection, 'metadata:coin:guest_qualifier'), 'guestQualifier');
         $properties += $this->setPathFromObjectString(array($connection, 'metadata:coin:schachomeorganization'), 'schacHomeOrganization');
         $properties += $this->assembleConsentSettings($connection);
         $properties += $this->setPathFromObjectBool(array($connection, 'metadata:coin:hidden'), 'hidden');

diff --git a/src/OpenConext/EngineBlock/Metadata/Entity/Disassembler/CortoDisassembler.php b/src/OpenConext/EngineBlock/Metadata/Entity/Disassembler/CortoDisassembler.php
@@ -104,8 +104,6 @@ public function translateIdentityProvider(IdentityProvider $entity)
             );
         }
 
-        $cortoEntity['GuestQualifier'] = $entity->getCoins()->guestQualifier();
-
         if ($entity->getCoins()->schacHomeOrganization()) {
             $cortoEntity['SchacHomeOrganization'] = $entity->getCoins()->schacHomeOrganization();
         }

diff --git a/src/OpenConext/EngineBlock/Metadata/Entity/IdentityProvider.php b/src/OpenConext/EngineBlock/Metadata/Entity/IdentityProvider.php
@@ -50,21 +50,6 @@
 #[ORM\Entity]
 class IdentityProvider extends AbstractRole
 {
-    const GUEST_QUALIFIER_ALL = 'All';
-    const GUEST_QUALIFIER_SOME = 'Some';
-    const GUEST_QUALIFIER_NONE = 'None';
-
-    /**
-     * In all-caps to indicate that though the language doesn't allow it, this should be an array constant.
-     *
-     * @var string[]
-     */
-    public static $GUEST_QUALIFIERS = array(
-        self::GUEST_QUALIFIER_ALL,
-        self::GUEST_QUALIFIER_SOME,
-        self::GUEST_QUALIFIER_NONE
-    );
-
     /**
      * @var bool
      */
@@ -145,7 +130,6 @@ public function __construct(
         string $workflowState = self::WORKFLOW_STATE_DEFAULT,
         string $manipulation = '',
         bool $enabledInWayf = true,
-        string $guestQualifier = self::GUEST_QUALIFIER_ALL,
         bool $hidden = false,
         ?string $schacHomeOrganization = null,
         array $shibMdScopes = array(),
@@ -196,7 +180,6 @@ public function __construct(
         $this->consentSettings = $consentSettings;
 
         $this->coins = Coins::createForIdentityProvider(
-            $guestQualifier,
             $schacHomeOrganization,
             $hidden,
             $stepupConnections,

diff --git a/src/OpenConext/EngineBlock/Stepup/StepupEntityFactory.php b/src/OpenConext/EngineBlock/Stepup/StepupEntityFactory.php
@@ -72,7 +72,6 @@ public static function idpFrom(StepupEndpoint $stepupEndpoint, ?string $acsLocat
             IdentityProvider::WORKFLOW_STATE_DEFAULT,
             '',
             false,
-            IdentityProvider::GUEST_QUALIFIER_ALL,
             true,
             null,
             [],
@@ -137,7 +136,7 @@ public static function spFrom(StepupEndpoint $stepupEndpoint, ?string $acsLocati
             [],
             false,
             $assertionConsumerServices,
-            IdentityProvider::GUEST_QUALIFIER_ALL,
+            true,
             true,
             null,
             [],

diff --git a/tests/functional/OpenConext/EngineBlockBundle/Controller/Api/ConnectionsControllerTest.php b/tests/functional/OpenConext/EngineBlockBundle/Controller/Api/ConnectionsControllerTest.php
@@ -637,7 +637,6 @@ private function validConnectionsWithCoinsData()
                 'name' => 'IDP1',
                 'type' => 'saml20-idp',
                 'coins' => [
-                    'guest_qualifier' => 'guest-qualifier',
                     'schachomeorganization' => 'schac-home-organization',
                     'hidden' => '0',
                     // abstract
@@ -646,7 +645,6 @@ private function validConnectionsWithCoinsData()
                     'signature_method' => 'signature-method',
                 ],
                 'expected-coins' => [
-                    'guestQualifier' => 'guest-qualifier',
                     'schacHomeOrganization' => 'schac-home-organization',
                     'hidden' => false,
                     // abstract
-Original file line number
+Diff line change
@@ Expand Up @@
                 );
             }
-            $cortoEntity['GuestQualifier'] = $entity->getCoins()->guestQualifier();
             if ($entity->getCoins()->schacHomeOrganization()) {
                 $cortoEntity['SchacHomeOrganization'] = $entity->getCoins()->schacHomeOrganization();
             }
@@ Expand Down @@