draft-ietf-calsch-inetcal-guide-01.txt   draft-ietf-calsch-inetcal-guide-02.txt 
Network Working Group B. Mahoney Network Working Group B. Mahoney
Internet-Draft MIT Internet-Draft MIT
Expires: January 16, 2002 G. Babics Expires: January 16, 2002 G. Babics
Steltor Steltor
A. Taler A. Taler
July 18, 2001 July 18, 2001
Guide to Internet Calendaring Guide to Internet Calendaring
draft-ietf-calsch-inetcal-guide-01 draft-ietf-calsch-inetcal-guide-02
Status of this Memo Status of this Memo
This document is an Internet-Draft and is in full conformance with This document is an Internet-Draft and is in full conformance with
all provisions of Section 10 of RFC2026. all provisions of Section 10 of RFC2026.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet- other groups may also distribute working documents as Internet-
Drafts. Drafts.
skipping to change at page 1, line 43 skipping to change at page 1, line 43
This Internet-Draft will expire on January 16, 2002. This Internet-Draft will expire on January 16, 2002.
Copyright Notice Copyright Notice
Copyright (C) The Internet Society (2001). All Rights Reserved. Copyright (C) The Internet Society (2001). All Rights Reserved.
Abstract Abstract
This document describes the various Internet calendaring and This document describes the various Internet calendaring and
scheduling standards and works in progress and the relationships scheduling standards and works in progress, and the relationships
between them. It's intention is to provide a context for these between them. Its intent is to provide a context for these
documents, assist in their understanding, and potentially help documents, assist in their understanding, and potentially help in the
implementers in the design of their standards based calendaring and design of standards-based calendaring and scheduling systems. The
scheduling systems. The standards addressed are RFC 2445 standards addressed are RFC 2445 (iCalendar), RFC 2446 (iTIP), and
(iCalendar), RFC 2446 (iTIP), and RFC 2447 (iMIP). The work in RFC 2447 (iMIP). The work in progress addressed is "Calendar Access
progress addressed is "Calendar Access Protocol" (CAP). This Protocol" (CAP). This document also describes issues and problems
document also describes issues and problems that are not solved by that are not solved by these protocols, and that could be targets for
these protocols, and could be targets for future work. future work.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
1.1 Terminology . . . . . . . . . . . . . . . . . . . . . . . . 3 1.1 Terminology . . . . . . . . . . . . . . . . . . . . . . . . 3
1.2 Concepts and Relationships . . . . . . . . . . . . . . . . . 5 1.2 Concepts and Relationships . . . . . . . . . . . . . . . . . 5
2. Requirements . . . . . . . . . . . . . . . . . . . . . . . . 6 2. Requirements . . . . . . . . . . . . . . . . . . . . . . . . 6
2.1 Fundamental Needs . . . . . . . . . . . . . . . . . . . . . 6 2.1 Fundamental Needs . . . . . . . . . . . . . . . . . . . . . 6
2.2 Protocol Requirements . . . . . . . . . . . . . . . . . . . 6 2.2 Protocol Requirements . . . . . . . . . . . . . . . . . . . 6
3. Solutions . . . . . . . . . . . . . . . . . . . . . . . . . 8 3. Solutions . . . . . . . . . . . . . . . . . . . . . . . . . 8
3.1 Examples . . . . . . . . . . . . . . . . . . . . . . . . . . 8 3.1 Examples . . . . . . . . . . . . . . . . . . . . . . . . . . 8
3.2 Systems . . . . . . . . . . . . . . . . . . . . . . . . . . 9 3.2 Systems . . . . . . . . . . . . . . . . . . . . . . . . . . 9
3.2.1 Standalone single-user system . . . . . . . . . . . . . . . 9 3.2.1 Standalone Single-user System . . . . . . . . . . . . . . . 9
3.2.2 Single-user systems communicating . . . . . . . . . . . . . 9 3.2.2 Single-user Systems Communicating . . . . . . . . . . . . . 9
3.2.3 Single-user with multiple CUA . . . . . . . . . . . . . . . 10 3.2.3 Single-user with Multiple CUAs . . . . . . . . . . . . . . . 10
3.2.4 Single-user with multiple calendars . . . . . . . . . . . . 10 3.2.4 Single-user with Multiple Calendars . . . . . . . . . . . . 10
3.2.5 Users communicating on a multi-user system . . . . . . . . . 11 3.2.5 Users Communicating on a Multi-user System . . . . . . . . . 11
3.2.6 Users communicating through different multi-user systems . . 11 3.2.6 Users Communicating through Different Multi-user Systems . . 11
4. Important Aspects . . . . . . . . . . . . . . . . . . . . . 12 4. Important Aspects . . . . . . . . . . . . . . . . . . . . . 12
4.1 Timezones . . . . . . . . . . . . . . . . . . . . . . . . . 12 4.1 Timezones . . . . . . . . . . . . . . . . . . . . . . . . . 12
4.2 Choice of Transport . . . . . . . . . . . . . . . . . . . . 12 4.2 Choice of Transport . . . . . . . . . . . . . . . . . . . . 12
4.3 Security . . . . . . . . . . . . . . . . . . . . . . . . . . 12 4.3 Security . . . . . . . . . . . . . . . . . . . . . . . . . . 12
4.4 Amount of data . . . . . . . . . . . . . . . . . . . . . . . 12 4.4 Amount of data . . . . . . . . . . . . . . . . . . . . . . . 12
4.5 Recurring Components . . . . . . . . . . . . . . . . . . . . 12 4.5 Recurring Components . . . . . . . . . . . . . . . . . . . . 12
5. Open Issues . . . . . . . . . . . . . . . . . . . . . . . . 14 5. Open Issues . . . . . . . . . . . . . . . . . . . . . . . . 14
5.1 Scheduling people, not calendars . . . . . . . . . . . . . . 14 5.1 Scheduling People, not Calendars . . . . . . . . . . . . . . 14
5.2 Administration . . . . . . . . . . . . . . . . . . . . . . . 14 5.2 Administration . . . . . . . . . . . . . . . . . . . . . . . 14
5.3 Notification . . . . . . . . . . . . . . . . . . . . . . . . 14 5.3 Notification . . . . . . . . . . . . . . . . . . . . . . . . 14
6. Security considerations . . . . . . . . . . . . . . . . . . 15 6. Security considerations . . . . . . . . . . . . . . . . . . 15
6.1 Access Control . . . . . . . . . . . . . . . . . . . . . . . 15 6.1 Access Control . . . . . . . . . . . . . . . . . . . . . . . 15
6.2 Authentication . . . . . . . . . . . . . . . . . . . . . . . 15 6.2 Authentication . . . . . . . . . . . . . . . . . . . . . . . 15
6.3 Using email . . . . . . . . . . . . . . . . . . . . . . . . 15 6.3 Using E-mail . . . . . . . . . . . . . . . . . . . . . . . . 15
6.4 Other issues . . . . . . . . . . . . . . . . . . . . . . . . 16 6.4 Other Issues . . . . . . . . . . . . . . . . . . . . . . . . 16
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . 16 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . 16
A. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . 17 A. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . 17
B. Bibliography . . . . . . . . . . . . . . . . . . . . . . . . 18 B. Bibliography . . . . . . . . . . . . . . . . . . . . . . . . 18
Full Copyright Statement . . . . . . . . . . . . . . . . . . 19 Full Copyright Statement . . . . . . . . . . . . . . . . . . 19
1. Introduction 1. Introduction
The calendaring and scheduling protocols are intended to provide for Calendaring and scheduling protocols are intended to aid individuals
the needs of individuals attempting to obtain calendaring information in obtaining calendaring information and scheduling meetings across
and schedule meetings across the Internet, organizations attempting the Internet, to aid organizations in providing calendaring
to provide calendaring information on the Internet, as well as information on the Internet, and to provide for organizations looking
organizations looking for a calendaring and scheduling solution to for a calendaring and scheduling solution to deploy internally.
deploy internally.
It is the intent of this document to provide a context for the It is the intent of this document to provide a context for these
calendar standards and works in progress, assist in their documents, assist in their understanding, and potentially help in the
understanding, and potentially help implementers in the design of design of standards-based calendaring and scheduling systems.
their Internet calendaring and scheduling systems.
Problems not solved by these protocols, as well as security issues to Problems not solved by these protocols, as well as security issues to
be kept in mind, are discussed at the end of the document. be kept in mind, are discussed at the end of the document.
1.1 Terminology 1.1 Terminology
This memo uses much of the same terminology as iCalendar [RFC-2445], This memo uses much of the same terminology as iCalendar [RFC-2445],
iTIP [RFC-2446], iMIP [RFC-2447], and [CAP]. The following iTIP [RFC-2446], iMIP [RFC-2447], and [CAP]. The following
definitions are provided as introductory, the definitions in the definitions are provided as an introducttion; the definitions in the
protocol specifications are the canonical ones. protocol specifications themselves should be considered canonical.
Calendar Calendar
A collection of events, to-dos, journal entries, etc. A calendar A collection of events, to-dos, journal entries, etc. A calendar
could be the content of a person or a resource's agenda; it could could be the content of a person or resource's agenda; it could
also be a collection of data serving a more specialized need. also be a collection of data serving a more specialized need.
Calendars are the basic storage containers for calendaring Calendars are the basic storage containers for calendaring
information. information.
Calendar Access Rights Calendar Access Rights
A set of rules for a calendar describing who may perform which A set of rules defining who may perform what operations, such as
operations on that calendar, such as reading and writing reading or writing information, on a given calendar.
information.
Calendar Service Calendar Service
A running server application which provides access to a collection A running server application that provides access to a number of
of calendars. calendars.
Calendar Store (CS) Calendar Store (CS)
A data store of a calendar service. A calendar service may have A data store of a calendar service. A calendar service may have
several calendar stores, and each store may contain several several calendar stores, and each store may contain several
calendars, as well as properties and components outside of the calendars, as well as properties and components outside of those
calendars. calendars.
Calendar User (CU) Calendar User (CU)
An entity (often a human) that accesses calendar information. An entity (often a human) that accesses calendar information.
Calendar User Agent (CUA) Calendar User Agent (CUA)
Software used by the calendar user that communicates with calendar Software with which the calendar user communicates with a calendar
services to provide the user access to calendar information. service or local calendar store to access calendar information.
Component Component
A piece of calendar data such as an event, a to-do or an alarm. A piece of calendar data such as an event, a to-do or an alarm.
Information about components is stored as properties of those Information about components is stored as properties of those
components. components.
Delegator Delegator
Is a calendar user (sometimes called the delegatee) who has A calendar user (sometimes called the delegatee) who has assigned
assigned his or her participation in a scheduled calendar his or her participation in a scheduled calendar component (e.g.
component (e.g., VEVENT) to another calendar user (sometimes a VEVENT) to another calendar user (sometimes called the delegate
called the delegate or delegatee). or delegatee). An example of a delegator is a busy executive
sending an employee to a meeting in his or her place.
Delegate Delegate
Is a calendar user (sometimes called the delegatee) who has been A calendar user (sometimes called the delegatee) who has been
assigned participation in a scheduled calendar component (e.g., assigned to participate in a scheduled calendar component (e.g. a
VEVENT) by one of the attendees in the scheduled calendar VEVENT) by one of the attendees in that component (sometimes
component (sometimes called the delegator). An example of a called the delegator). An example of a delegate is a team member
delegate is a team member told to go to a particular meeting. sent to a particular meeting.
Designate Designate
Is a calendar user who is authorized to act on behalf of another A calendar user authorized to act on behalf of another calendar
calendar user. An example of a designate is an assistant. user. An example of a designate is an assistant scheduling
meetings for his or her superior.
Local Store Local Store
A CS which is on the same platform as the CUA. A CS that is on the same device as the CUA.
Property Property
A property of a component, such as a description or a start time. A description of some element of a component, such as a start
time, title or location.
Remote Store Remote Store
A CS which is not on the same platform as the CUA. A CS that is not on the same device as the CUA.
1.2 Concepts and Relationships 1.2 Concepts and Relationships
iCalendar is the language used to describe calendar objects. iTIP is iCalendar is the language used to describe calendar objects. iTIP
a way to use the language to do scheduling. iMIP is how to do iTIP describes a way to use the iCalendar language to do scheduling. iMIP
with email. CAP is a way to use the language, to access a calendar describes how to do iTIP scheduling via e-mail. CAP describes a way
store in real-time. to use the iCalendar language to access a calendar store in real-
time.
The relationship between the calendaring protocols is similar to that The relationship between calendaring protocols is similar to that
between the email protocols. In those terms iCalendar is like RFC between e-mail protocols. In those terms, iCalendar is analogous to
822, iTIP and iMIP are like SMTP, and CAP is like POP or IMAP. RFC 822, iTIP and iMIP are analogous to the Simple Mail Transfer
Protocol (SMTP), and CAP is analogous to the Post Office Protocol
(POP) or Internet Message Access Protocol (IMAP).
2. Requirements 2. Requirements
2.1 Fundamental Needs 2.1 Fundamental Needs
The following examples illustrate people's and organizations' basic The following scenarios illustrate people and organizations' basic
calendaring and scheduling needs: calendaring and scheduling needs:
a] A doctor wishes to keep track of all his appointments. a] A doctor wishes to keep track of all her appointments.
Need: Read and manipulate one's own calendar with only one CUA. Need: To read and manipulate one's own calendar with only one CUA.
b] A busy musician wants to maintain her schedule with different b] A busy musician wants to maintain her schedule with multiple
devices, such as with an Internet-based agenda or with a PDA. devices, such as through an Internet-based agenda and with a PDA.
Need: Read and manipulate one's own calendar, possibly with Need: To read and manipulate one's own calendar, possibly with
solutions from different vendors. solutions from different vendors.
c] A software development team wishes to share agenda information c] A software development team wishes to more effectively schedule
by using a group scheduling product in order to more effectively their time through viewing each other's calendar information.
schedule their time.
Need: Share calendar information with users using the same Need: To share calendar information between users of the same
calendar service. calendar service.
d] A teacher wants his students to be able to schedule calendar d] A teacher wants his students to schedule appointments during
entries during his office hours. his office hours.
Need: Schedule calendar events, to-dos and journals with users Need: To schedule calendar events, to-dos and journals with other
using the same calendar service. users of the same calendar service.
e] A movie theater wants to publish its schedule so that e] A movie theater wants to publish its schedule for prospective
prospective customers can easily access it. customers.
Need: Share calendar information with users using other calendar Need: To share calendar information with users of other calendar
services, possibly from different vendors. services, possibly from multiple different vendors.
f] A social club wants to be able to schedule calendar entries f] A social club wants to schedule calendar entries effectively
effectively with its members. with its members.
Need: Schedule calendar events and to-dos with users using other Need: To schedule calendar events and to-dos with users of other
calendar services, possibly from different vendors. calendar services, possibly from multiple different vendors.
2.2 Protocol Requirements 2.2 Protocol Requirements
Some of the needs can be met with proprietary solutions (a, c, d), Some of these needs can be met by proprietary solutions (a, c, d),
but others can not (b, e, f). From these needs we can establish that but others can not (b, e, f). These latter scenarios show that
protocols are required for accessing information in a calendar store, standard protocols are required for accessing information in a
and for scheduling calendar entries. In addition these protocols calendar store and scheduling calendar entries. In addition, these
require a data format for representing calendar information. protocols require a common data format for representing calendar
information.
These roles are filled by the following protocol specifications. These requirements are met by the following protocol specifications.
- iCalendar [RFC-2445] is the data format - Data format: iCalendar [RFC-2445]
iCalendar [RFC-2445] provides data format for representing iCalendar [RFC-2445] provides a data format for representing
calendar information which the other protocols can use. iCalendar calendar information, to be used and exchanged by other protocols.
[RFC-2445] can also be used in other contexts such as a drag and iCalendar [RFC-2445] can also be used in other contexts, such as a
drop format or an export/import format. All the other protocols drag-and-drop interface, or an export/import feature. All the
depend on iCalendar [RFC-2445], so all elements of a standards- other calendaring protocols depend on iCalendar [RFC-2445], so all
based calendaring and scheduling systems will have to interpret elements of a standards-based calendaring and scheduling systems
iCalendar [RFC-2445]. will have to be able interpret iCalendar [RFC-2445].
- iTIP [RFC-2446] is the scheduling protocol - Scheduling protocol: iTIP [RFC-2446]
iTIP [RFC-2446] describes the messages used to schedule calendar iTIP [RFC-2446] describes the messages used to schedule calendar
events. These messages are represented in iCalendar [RFC-2445], events. Within iTIP messages, events are represented in iCalendar
and have semantics that include such things as being an invitation [RFC-2445] format, and have semantics that identify the message as
to a meeting, an acceptance of an invitation or the assignment of being an invitation to a meeting, an acceptance of an invitation,
a task. or the assignment of a task.
iTIP [RFC-2446] messages are used in the scheduling workflow, iTIP [RFC-2446] messages are used in the scheduling workflow,
where users exchange messages in order to organize things such as where users exchange messages in order to organize things such as
events and to-dos. CUAs generate and interpret iTIP [RFC-2446] events and to-dos. CUAs generate and interpret iTIP [RFC-2446]
messages at the direction of the calendar user. With iTIP [RFC- messages at the direction of the calendar user. With iTIP [RFC-
2446] one can create, modify, delete, reply to, counter, and 2446] users can create, modify, delete, reply to, counter, and
decline counters to the various iCalendar [RFC-2445] components. decline counters to the various iCalendar [RFC-2445] components.
Furthermore, one can also request the free/busy time of other Furthermore, users can also request the free/busy time of other
people. people.
iTIP [RFC-2446] is transport-independent, and has one specified iTIP [RFC-2446] is transport-independent, and has one specified
transport bindings: iMIP [RFC-2447] is a binding to email. In transport binding: iMIP [RFC-2447] binds iTIP to e-mail. In
addition [CAP] will provide a real-time binding of iTIP [RFC- addition [CAP] will provide a real-time binding of iTIP [RFC-
2446], allowing CUAs to perform calendar management as well as 2446], allowing CUAs to perform calendar management and scheduling
scheduling over a single connection. over a single connection.
- [CAP] is the calendar management protocol - Calendar management protocol: [CAP]
[CAP] describes the messages used to manage calendars on a [CAP] describes the messages used to manage calendars on a
calendar store. These messages use iCalendar [RFC-2445] to calendar store. These messages use iCalendar [RFC-2445] to
describe various components such as events and to-dos. With these describe various components such as events and to-dos. These
messages one can do the operations in iTIP [RFC-2446] and other messages make it possible to perform iTIP [RFC-2446] operations,
operations relating to a calendar store, such as search, creating as well as other operations relating to a calendar store such as
calendars, specifying calendar properties, and being able to searching, creating calendars, specifying calendar properties, and
specify access rights to one's calendars. specifying calendar access rights.
3. Solutions 3. Solutions
3.1 Examples 3.1 Examples
Returning to the examples of section 2.1, they can be solved using Returning to the scenarios presented in section 2.1, the calendaring
the protocols in the following ways: protocols can be used in the following ways:
a] The doctor can use a proprietary CUA with a local store, and a] The doctor can use a proprietary CUA with a local store, and
perhaps use iCalendar [RFC-2445] as a storage mechanism. This perhaps use iCalendar [RFC-2445] as a storage mechanism. This
would allow the doctor to easily import his store into another would allow her to easily import her data store into another
application that supports iCalendar [RFC-2445]. application that supports iCalendar [RFC-2445].
b] The musician who wishes to access her agenda from anywhere can b] The musician who wishes to access her agenda from anywhere can
use a [CAP] enabled calendar service accessible through the use a [CAP]-enabled calendar service accessible over the Internet.
Internet. She can then use whichever [CAP] clients are available She can then use any available [CAP] clients to access the data.
to access the data.
A proprietary system could also be employed which provides access A proprietary system that provides access through a Web-based
through a web-based interface, but the use of [CAP] would be interface could also be employed, but the use of [CAP] would be
superior in that it would allow the use of third party tools, such superior in that it would allow the use of third party
as PDA synchronization tools. applications such as PDA synchronization tools.
c] The development team can use a calendar service which supports c] The development team can use a calendar service which supports
[CAP] and then each member can use a [CAP]-enabled CUA of their [CAP], and each member can use a [CAP]-enabled CUA of their
choice. choice.
Alternatively, each member could use an iMIP [RFC-2447]-enabled Alternatively, each member could use an iMIP [RFC-2447]-enabled
CUA, and they could book meetings over email. This solution has CUA, and they could book meetings over e-mail. This solution has
the drawback that it is difficult to examine the other agendas, the drawback that it is difficult to examine other users' agendas,
making organizing meetings more difficult. making organizing meetings more difficult.
Proprietary solutions are also available, but they require that Proprietary solutions are also available, but they require that
all people use clients by the same vendor, and disallow the use of all members use clients by the same vendor, and disallow the use
third party applications. of third party applications.
d] The teacher can set up a calendar service, and have students d] The teacher can set up a calendar service, and have students
book time through any of the iTIP [RFC-2446] bindings. [CAP] book time through any of the iTIP [RFC-2446] bindings. [CAP]
provides real-time access, but could require additional provides real-time access, but could require additional
configuration. iMIP [RFC-2447] would be the easiest to configure, configuration. iMIP [RFC-2447] would be the easiest to configure,
but may require more email processing. but may require more e-mail processing.
If [CAP] access is provided then determining the state of the If [CAP] access is provided then determining the state of the
teacher's schedule is straightforward. If not, this can be teacher's schedule is straightforward. If not, this can be
determined through iTIP [RFC-2446] free/busy requests. Non- determined through iTIP [RFC-2446] free/busy requests. Non-
standard methods could also be employed, such as serving up ICAL, standard methods could also be employed, such as serving up iCAL,
HTML, XML over HTTP. HTML, and XML over HTTP.
A proprietary system could also be used, but would require that A proprietary system could also be used, but would require that
all students be able to use software from a specific vendor. all students be able to use software from a specific vendor.
e] For publishing a movie theater's schedule [CAP] provides the e] [CAP] would be preferred for publishing a movie theater's
most advanced access and search capabilities. It also allows easy schedule, since it provides advanced access and search
integration with its customer's calendar systems. capabilities. It also allows easy integration with customers'
calendar systems.
Non-standard methods such as serving data over HTTP could also be Non-standard methods such as serving data over HTTP could also be
employed, but would be harder to integrate with customer's employed, but would be harder to integrate with customers'
systems. systems.
Using a completely proprietary solutions would be very difficult Using a completely proprietary solution would be very difficult,
since it would require every user to install and use proprietary if not impossible, since it would require every user to install
software. and use the proprietary software.
f] The social club could distribute meeting information in the f] The social club could distribute meeting information in the
form of iTIP [RFC-2446] messages. This could be done over email form of iTIP [RFC-2446] messages, sent via e-mail using iMIP [RFC-
using iMIP [RFC-2447]. Meeting invitations, as well as a full 2447]. The club could distribute meeting invitations, as well as
published agenda could be distributed. a full published agenda.
Alternatively, the social club could provide access to a [CAP] Alternatively, the club could provide access to a [CAP]-enabled
enabled calendar service, however this solution would be more calendar service. However, this solution would be more expensive
expensive since it requires the maintenance of a server. since it requires the maintenance of a server.
3.2 Systems 3.2 Systems
The following diagrams illustrate possible example systems and usage The following diagrams illustrate possible systems and their usage of
of the protocols. the various protocols.
3.2.1 Standalone single-user system 3.2.1 Standalone Single-user System
A single user system that does not communicate with other systems A single user system that does not communicate with other systems
need not employ any of the protocols. However, it may use iCalendar need not employ any of the protocols. However, it may use iCalendar
[RFC-2445] as a data format in some places. [RFC-2445] as a data format in some places.
----------- O ----------- O
| CUA w/ | -+- user | CUA w/ | -+- user
|local store| A |local store| A
----------- / \ ----------- / \
3.2.2 Single-user systems communicating 3.2.2 Single-user Systems Communicating
Users with single-user systems may schedule meetings with each other Users with single-user systems may schedule meetings with each other
using iTIP [RFC-2446]. The easiest binding of iTIP [RFC-2446] to use using iTIP [RFC-2446]. The easiest binding of iTIP [RFC-2446] to use
is iMIP [RFC-2447], since since the messages can be held in their would be iMIP [RFC-2447], since messages can be held in the users'
mail queue, which we assume to already exist. [CAP] could also be mail queues, which we assume to already exist. [CAP] could also be
used. used.
O ----------- ----------- O O ----------- ----------- O
-+- | CUA w/ | -----[IMIP]----- | CUA w/ | -+- user -+- | CUA w/ | -----[iMIP]----- | CUA w/ | -+- user
A |local store| Internet |local store| A A |local store| Internet |local store| A
/ \ ----------- ----------- / \ / \ ----------- ----------- / \
3.2.3 Single-user with multiple CUA 3.2.3 Single-user with Multiple CUAs
A single user may use more than one CUA to access his or her A single user may use more than one CUA to access his or her
calendar. The user may use a PDA, a web client, a PC, or some other calendar. The user may use a PDA, a Web client, a PC, or some other
device, depending an accessibility. Some of these clients may have device, depending on accessibility. Some of these clients may have
local stores and others may not. If they do, then they need to local stores and others may not. Those with local stores need to
ensure that the data on the CUA is synchronized with the data on the synchronize the data on the CUA with the data on the CS.
CS.
----------- -----------
| CUA w | -----[CAP]----------+ | CUA w | -----[CAP]----------+
|local store| | |local store| |
O ----------- ---------- O ----------- ----------
-+- | CS | -+- | CS |
A | | A | |
/ \ ---------- / \ ----------
----------- | ----------- |
| CUA w/o | -----[CAP]----------+ | CUA w/o | -----[CAP]----------+
|local store| |local store|
----------- -----------
3.2.4 Single-user with multiple calendars 3.2.4 Single-user with Multiple Calendars
A single user may have many independent calendars. One may be work A single user may have many independent calendars; for example, one
related, another for personal use. The CUA may or may not have a may contain work-related information and another personal
local store. If it does, then it needs to ensure that the data on information. The CUA may or may not have a local store. If it does,
the CUA is synchronized with the data on both of the CS. then it needs to synchronize the data of the CUA with the data on
both of the CS.
---------- ----------
+------------[CAP]------ | CS | +------------[CAP]------ | CS |
| | | | | |
O ----------- ---------- O ----------- ----------
-+- | CUA | -+- | CUA |
A | | A | |
/ \ ----------- / \ -----------
| ---------- | ----------
+------------[CAP]------ | CS | +------------[CAP]------ | CS |
| | | |
---------- ----------
3.2.5 Users communicating on a multi-user system 3.2.5 Users Communicating on a Multi-user System
Users on a multi-user system may schedule meetings with each other Users on a multi-user system may schedule meetings with each other
using [CAP]-enabled CUA and service. The CUA may or may not have a using [CAP]-enabled CUAs and services. The CUAs may or may not have
local store. If they do, then they need to ensure that the data on local stores. Those with local stores need to synchronize the data
the CUA is synchronized with the data on the CS. on the CUAs with the data on the CS.
O ----------- O -----------
-+- | CUA w | -----[CAP]----------+ -+- | CUA w | -----[CAP]----------+
A |local store| | A |local store| |
/ \ ----------- ---------- / \ ----------- ----------
| CS | | CS |
| | | |
---------- ----------
O ----------- | O ----------- |
-+- | CUA w/o | -----[CAP]----------+ -+- | CUA w/o | -----[CAP]----------+
A |local store| A |local store|
/ \ ----------- / \ -----------
3.2.6 Users communicating through different multi-user systems 3.2.6 Users Communicating through Different Multi-user Systems
Users on a multi-user system may need to schedule meetings with user Users on a multi-user system may need to schedule meetings with users
on a different multi user system. The services can communicate using on a different multi-user system. The services can communicate using
[CAP] or iMIP [RFC-2447]. [CAP] or iMIP [RFC-2447].
O ----------- ---------- O ----------- ----------
-+- | CUA w | -----[CAP]-------| CS | -+- | CUA w | -----[CAP]-------| CS |
A |local store| | | A |local store| | |
/ \ ----------- ---------- / \ ----------- ----------
| |
[CAP] or [iMIP] [CAP] or [iMIP]
| |
O ----------- ---------- O ----------- ----------
-+- | CUA w/o | -----[CAP]-------| CS | -+- | CUA w/o | -----[CAP]-------| CS |
A |local store| | | A |local store| | |
/ \ ----------- ---------- / \ ----------- ----------
4. Important Aspects 4. Important Aspects
There are a number of important aspects of these calendaring There are a number of important aspects of these calendaring
documents of which people, especially implementers, should be aware. standards of which people, especially implementers, should be aware.
4.1 Timezones 4.1 Timezones
The dates and times in components can refer to time zones. These The dates and times in components can refer to a specific time zone.
time zones can be defined in some central store, or they may be Time zones can be defined in a central store, or they may be defined
defined by a user to fit his or her needs. Any user and application by a user to fit his or her needs. All users and applications should
should be aware of time zones and time zone differences. New time be aware of time zones and time zone differences. New time zones may
zones may be added, and others removed. Two different vendors may need to be added, and others removed. Two different vendors may
describe the same time zone differently (such as by using a different describe the same time zone differently (such as by using a different
name). name).
4.2 Choice of Transport 4.2 Choice of Transport
There are issues to be aware of in choosing a transport mechanism. There are issues to be aware of in choosing between a network
The choices are a network protocol, such as CAP, or a store and protocol such as [CAP], or a store and forward (e-mail) solution.
forward (email) solution.
The use of a network ("on-the-wire") mechanism may require some The use of a network ("on-the-wire") mechanism may require some
organizations to make provisions to allow calendaring traffic to organizations to make provisions to allow calendaring traffic to
traverse a corporate firewall on the required ports. Depending on traverse a corporate firewall on the required ports. Depending on
the organizational culture, this may be a challenging social the organizational culture, this may be a challenging social
exercise. exercise.
The use of an email-based mechanism exposes innately time sensitive The use of an email-based mechanism exposes time-sensitive data to
data to unbounded latency. Large or heavily utilized mail systems unbounded latency. Large or heavily utilized mail systems may
may experience an unacceptable delay in message receipt. experience an unacceptable delay in message receipt.
4.3 Security 4.3 Security
See the "Security Considerations" (Section 6) section below. See the "Security Considerations" (Section 6) section below.
4.4 Amount of data 4.4 Amount of data
In some cases a component may be very large. For instance, some In some cases, a component may be very large, for instance, a
attachments may be very large. Some applications may be low- component with a very large attachment. Some applications may be
bandwidth or be limited in the amount of data they can store. The low- bandwidth or may be limited in the amount of data they can
size of the data may be controlled in [CAP], by specifying maximums. store. Maximum component size may be set in [CAP]. It can also be
In iMIP [RFC-2447] it can be controlled, by restricting the maximum controlled in iMIP [RFC-2447] by restricting the maximum size of the
size of the email that the application can download. e-mail that the application can download.
4.5 Recurring Components 4.5 Recurring Components
In iCAL [RFC-2445] one can specify complex recurrence rules for In iCAL [RFC-2445] one can specify complex recurrence rules for
VEVENTs, VTODOs, and VJOURNALs. There is the danger that VEVENTs, VTODOs, and VJOURNALs. One must be careful to correctly
applications interpret these rules differently. Thus, one must make interpret these recurrence rules and pay extra attention to being
sure that one is careful with recurrence rules. able to interoperate using them.
5. Open Issues 5. Open Issues
Many issues are not currently resolved by these protocols, and many Many issues are not currently resolved by these protocols, and many
desirable features are not yet provided. Some of the more prominent desirable features are not yet provided. Some of the more prominent
ones follow. ones are outlined below.
5.1 Scheduling people, not calendars 5.1 Scheduling People, not Calendars
Meetings are scheduled with people, however people may have many Meetings are scheduled with people; however, people may have many
calendars, and may store these calendars in many places. There may calendars, and may store these calendars in many places. There may
also be many routes to contact them. These protocols do not attempt also be many routes to contact them. The calendaring protocols do
to provide unique access for contacting a single person. Instead, not attempt to provide unique access for contacting a given person.
'calendar addresses' are booked, which may be email addresses or Instead, 'calendar addresses' are booked, which may be e-mail
individual calendars. It is up to the users themselves to addresses or individual calendars. It is up to the users themselves
orchestrate mechanisms to ensure that the bookings go to the right to orchestrate mechanisms to ensure that the bookings go to the right
place. place.
5.2 Administration 5.2 Administration
These protocols do not address the issues of administering users and The calendaring protocols do not address the issues of administering
calendars on a calendar service. This must be handled by proprietary users and calendars on a calendar service. This must be handled by
mechanisms for each implementation. proprietary mechanisms for each implementation.
5.3 Notification 5.3 Notification
People often wish to be notified of upcoming events, new events, or People often wish to be notified of upcoming events, new events, or
changes to events. These protocols do not attempt to address these changes to existing events. The calendaring protocols do not attempt
needs in a real-time fashion. Instead, the ability to store alarm to address these needs in a real-time system. Instead, the ability
information on events is provided, which can be used to provide to store alarm information on events is provided, which can be used
client-side notification of upcoming events. To organize to provide client-side notification of upcoming events. To organize
notification of new or changed events clients will have to poll the notification of new or changed events, clients have to poll the data
data store. store.
6. Security considerations 6. Security considerations
6.1 Access Control 6.1 Access Control
There has to be reasonable granularity in the configuration options There has to be reasonable granularity in the configuration options
for access to data through [CAP], so that what should be released to for access to data through [CAP], so that what should be released to
requesters is released, and what shouldn't isn't. Details of requesters is released, and what shouldn't is not. Details of
handling this are described in [CAP]. handling this are described in [CAP].
6.2 Authentication 6.2 Authentication
Access control must be coupled with a good authentication system, so Access control must be coupled with a good authentication system, so
that the right people get the right information. For [CAP] this that the right people get the right information. For [CAP] this
means requiring authentication before any database access can be means requiring authentication before any database access can be
performed, and checking access rights and authentication credentials performed, and checking access rights and authentication credentials
before releasing information. [CAP] uses SASL for this before releasing information. [CAP] uses the Simple Authentication
authentication. In iMIP [RFC-2447], this may present some Security Layer (SASL) for this authentication. In iMIP [RFC-2447],
challenges, as authentication is often not a consideration in store- this may present some challenges, as authentication is often not a
and-forward protocols. consideration in store-and-forward protocols.
Authentication is also important for scheduling, in that receivers of Authentication is also important for scheduling, in that receivers of
scheduling messages should be able to validate the apparent sender. scheduling messages should be able to validate the apparent sender.
Since scheduling messages are wrapped in MIME [RFC-2045], signing and Since scheduling messages are wrapped in MIME [RFC-2045], signing and
encryption is available for free. For messages transmitted over mail encryption are freely available. For messages transmitted over mail
this is the only available alternative. It is suggested that this is the only available alternative. It is suggested that
developers take care in implementing the security features in iMIP developers take care in implementing the security features in iMIP
[RFC-2447], bearing in mind that the concept and need may be foreign [RFC-2447], bearing in mind that the concept and need may be foreign
or non-obvious to users, yet essential for the system to function as or non-obvious to users, yet essential for the system to function as
they might expect. they might expect.
The real-time protocols provide for the authentication of users, and The real-time protocols provide for the authentication of users, and
the preservation of that authentication information, allowing for the preservation of that authentication information, allowing for
validation by the receiving end-user or server. validation by the receiving end-user or server.
6.3 Using email 6.3 Using E-mail
Because scheduling information can be transmitted over mail without Because scheduling information can be transmitted over mail without
any authentication information, email spoofing is extremely easy if any authentication information, e-mail spoofing is extremely easy if
the receiver is not checking for authentication. It is suggested the receiver is not checking for authentication. It is suggested
that implementers consider requiring authentication as a default, that implementers consider requiring authentication as a default,
using mechanisms such as are described in Section 3 of iMIP [RFC- using mechanisms such as are described in Section 3 of iMIP [RFC-
2447]. The use of email, and the potential for anonymous 2447]. The use of e-mail, and the potential for anonymous
connections, means that 'calendar spam' is possible. Developers connections, means that 'calendar spam' is possible. Developers
should consider this threat when designing systems, particularly should consider this threat when designing systems, particularly
those that allow for automated request processing. those that allow for automated request processing.
6.4 Other issues 6.4 Other Issues
The current security context should be obvious to users. Because the The current security context should be obvious to users. Because the
underlying mechanisms may not be clear to users, efforts to make underlying mechanisms may not be clear to users, efforts to make
clear the current state in the UI should be made. One example is the clear the current state in the UI should be made. One example of
'lock' icon used in some web browsers during secure connections. this is the 'lock' icon used in some Web browsers during secure
With both iMIP [RFC-2447] and [CAP], the possibilities of Denial of connections. With both iMIP [RFC-2447] and [CAP], the possibilities
Service attacks must be considered. The ability to flood a calendar of Denial of Service attacks must be considered. The ability to
system with bogus requests is likely to be exploited once these flood a calendar system with bogus requests is likely to be exploited
systems become widely deployed, and detection and recovery methods once these systems become widely deployed, and detection and recovery
will need to be considered. methods will need to be considered.
Authors' Addresses Authors' Addresses
Bob Mahoney Bob Mahoney
MIT MIT
E40-327 E40-327
77 Massachusetts Avenue 77 Massachusetts Avenue
Cambridge, MA 02139 Cambridge, MA 02139
US US
skipping to change at page 17, line 7 skipping to change at page 17, line 7
Phone: (514) 733-8500 x4201 Phone: (514) 733-8500 x4201
EMail: georgeb@steltor.com EMail: georgeb@steltor.com
Alex Taler Alex Taler
EMail: dissent@elea.dhs.org EMail: dissent@elea.dhs.org
Appendix A. Acknowledgments Appendix A. Acknowledgments
Thanks to the following who have participated in the development of Thanks to the following, who have participated in the development of
this document: this document:
Eric Busboom, Pat Egen, David Madeo, Shawn Packwood, Bruce Kahn. Eric Busboom, Pat Egen, David Madeo, Shawn Packwood, Bruce Kahn,
Alan Davies, Robb Surridge.
Appendix B. Bibliography Appendix B. Bibliography
[RFC-2445] Dawson, F. and D. Stenerson, "Internet Calendaring [RFC-2445] Dawson, F. and D. Stenerson, "Internet Calendaring
and Scheduling Core Object Specification - iCalendar", RFC 2445, and Scheduling Core Object Specification - iCalendar", RFC 2445,
November 1998. November 1998.
[RFC-2446] Silverberg, S., Mansour, S., Dawson, F. and R. [RFC-2446] Silverberg, S., Mansour, S., Dawson, F. and R.
Hopson, "iCalendar Transport-Independent Interoperability Protocol Hopson, "iCalendar Transport-Independent Interoperability Protocol
(iTIP): Scheduling Events, Busy Time, To-dos and Journal Entries", (iTIP): Scheduling Events, Busy Time, To-dos and Journal Entries",
 End of changes. 96 change blocks. 
227 lines changed or deleted 229 lines changed or added

This html diff was produced by rfcdiff 1.34. The latest version is available from http://tools.ietf.org/tools/rfcdiff/