3283
INFORMATIONAL
Guide to Internet Calendaring
Authors: B. Mahoney, G. Babics, A. Taler
Date: June 2002
Area: app
Working Group: calsch
Stream: IETF
Abstract
This document describes the various Internet calendaring and scheduling standards and works in progress, and the relationships between them. Its intent is to provide a context for these documents, assist in their understanding, and potentially aid in the design of standards-based calendaring and scheduling systems. The standards addressed are RFC 2445 (iCalendar), RFC 2446 (iTIP), and RFC 2447 (iMIP). The work in progress addressed is "Calendar Access Protocol" (CAP). This document also describes issues and problems that are not solved by these protocols, and that could be targets for future work. This memo provides information for the Internet community.
RFC 3283
INFORMATIONAL
Network Working Group B. Mahoney
Request for Comments: 3283 MIT
Category: Informational G. Babics
Steltor
A. Taler
June 2002
<span class="h1">Guide to Internet Calendaring</span>
Status of this Memo
This memo provides information for the Internet community. It does
not specify an Internet standard of any kind. Distribution of this
memo is unlimited.
Copyright Notice
Copyright (C) The Internet Society (2002). All Rights Reserved.
Abstract
This document describes the various Internet calendaring and
scheduling standards and works in progress, and the relationships
between them. Its intent is to provide a context for these
documents, assist in their understanding, and potentially aid in the
design of standards-based calendaring and scheduling systems. The
standards addressed are <a href="./rfc2445">RFC 2445</a> (iCalendar), <a href="./rfc2446">RFC 2446</a> (iTIP), and
<a href="./rfc2447">RFC 2447</a> (iMIP). The work in progress addressed is "Calendar Access
Protocol" (CAP). This document also describes issues and problems
that are not solved by these protocols, and that could be targets for
future work.
Table of Contents
<a href="#section-1">1</a>. Introduction . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-2">2</a>
<a href="#section-1.1">1.1</a> Terminology . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-2">2</a>
<a href="#section-1.2">1.2</a> Concepts and Relationships . . . . . . . . . . . . . . . . . <a href="#page-4">4</a>
<a href="#section-2">2</a>. Requirements . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-4">4</a>
<a href="#section-2.1">2.1</a> Fundamental Needs . . . . . . . . . . . . . . . . . . . . . <a href="#page-4">4</a>
<a href="#section-2.2">2.2</a> Protocol Requirements . . . . . . . . . . . . . . . . . . . <a href="#page-5">5</a>
<a href="#section-3">3</a>. Solutions . . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-7">7</a>
<a href="#section-3.1">3.1</a> Examples . . . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-7">7</a>
<a href="#section-3.2">3.2</a> Systems . . . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-8">8</a>
<a href="#section-3.2.1">3.2.1</a> Standalone Single-user System . . . . . . . . . . . . . . . <a href="#page-8">8</a>
<a href="#section-3.2.2">3.2.2</a> Single-user Systems Communicating . . . . . . . . . . . . . <a href="#page-8">8</a>
<a href="#section-3.2.3">3.2.3</a> Single-user with Multiple CUAs . . . . . . . . . . . . . . . <a href="#page-9">9</a>
<a href="#section-3.2.4">3.2.4</a> Single-user with Multiple Calendars . . . . . . . . . . . . <a href="#page-9">9</a>
<span class="grey">Mahoney, et. al. Informational [Page 1]</span><span id="page-2" ></span>
<span class="grey"><a href="./rfc3283">RFC 3283</a> Guide to Internet Calendaring June 2002</span>
<a href="#section-3.2.5">3.2.5</a> Users Communicating on a Multi-user System . . . . . . . . . <a href="#page-10">10</a>
<a href="#section-3.2.6">3.2.6</a> Users Communicating through Different Multi-user Systems . . <a href="#page-10">10</a>
<a href="#section-4">4</a>. Important Aspects . . . . . . . . . . . . . . . . . . . . . <a href="#page-10">10</a>
<a href="#section-4.1">4.1</a> Timezones . . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-10">10</a>
<a href="#section-4.2">4.2</a> Choice of Transport . . . . . . . . . . . . . . . . . . . . <a href="#page-11">11</a>
<a href="#section-4.3">4.3</a> Security . . . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-11">11</a>
<a href="#section-4.4">4.4</a> Amount of data . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-11">11</a>
<a href="#section-4.5">4.5</a> Recurring Components . . . . . . . . . . . . . . . . . . . . <a href="#page-11">11</a>
<a href="#section-5">5</a>. Open Issues . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-11">11</a>
<a href="#section-5.1">5.1</a> Scheduling People, not Calendars . . . . . . . . . . . . . . <a href="#page-12">12</a>
<a href="#section-5.2">5.2</a> Administration . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-12">12</a>
<a href="#section-5.3">5.3</a> Notification . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-12">12</a>
<a href="#section-6">6</a>. Security Considerations . . . . . . . . . . . . . . . . . . <a href="#page-12">12</a>
<a href="#section-6.1">6.1</a> Access Control . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-12">12</a>
<a href="#section-6.2">6.2</a> Authentication . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-12">12</a>
<a href="#section-6.3">6.3</a> Using E-mail . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-13">13</a>
<a href="#section-6.4">6.4</a> Other Issues . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-13">13</a>
Acknowledgments . . . . . . . . . . . . . . . . . . . . . . <a href="#page-13">13</a>
References . . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-14">14</a>
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . <a href="#page-15">15</a>
Full Copyright Statement . . . . . . . . . . . . . . . . . . <a href="#page-16">16</a>
<span class="h2"><a class="selflink" id="section-1" href="#section-1">1</a>. Introduction</span>
Calendaring and scheduling protocols are intended to aid individuals
in obtaining calendaring information and scheduling meetings across
the Internet, to aid organizations in providing calendaring
information on the Internet, and to provide for organizations looking
for a calendaring and scheduling solution to deploy internally.
It is the intent of this document to provide a context for these
documents, assist in their understanding, and potentially help in the
design of standards-based calendaring and scheduling systems.
Problems not solved by these protocols, as well as security issues to
be kept in mind, are discussed at the end of the document.
<span class="h3"><a class="selflink" id="section-1.1" href="#section-1.1">1.1</a> Terminology</span>
This memo uses much of the same terminology as iCalendar [<a href="./rfc2445" title=""Internet Calendaring and Scheduling Core Object Specification - iCalendar"">RFC-2445</a>],
iTIP [<a href="./rfc2446" title=""iCalendar Transport-Independent Interoperability Protocol (iTIP): Scheduling Events, Busy Time, To-dos and Journal Entries"">RFC-2446</a>], iMIP [<a href="./rfc2447" title=""iCalendar Message-Based Interoperability Protocol - iMIP"">RFC-2447</a>], and [<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>]. The following
definitions are provided as an introduction; the definitions in the
protocol specifications themselves should be considered canonical.
<span class="grey">Mahoney, et. al. Informational [Page 2]</span><span id="page-3" ></span>
<span class="grey"><a href="./rfc3283">RFC 3283</a> Guide to Internet Calendaring June 2002</span>
Calendar
A collection of events, to-dos, journal entries, etc. A calendar
could be the content of a person or resource's agenda; it could
also be a collection of data serving a more specialized need.
Calendars are the basic storage containers for calendaring
information.
Calendar Access Rights
A set of rules defining who may perform what operations, such as
reading or writing information, on a given calendar.
Calendar Service
A running server application that provides access to a number of
calendar stores.
Calendar Store (CS)
A data store of a calendar service. A calendar service may have
several calendar stores, and each store may contain several
calendars, as well as properties and components outside of those
calendars.
Calendar User (CU)
An entity (often a human) that accesses calendar information.
Calendar User Agent (CUA)
Software with which the calendar user communicates with a calendar
service or local calendar store to access calendar information.
Component
A piece of calendar data such as an event, a to-do or an alarm.
Information about components is stored as properties of those
components.
Delegator
A calendar user who has assigned his or her participation in a
scheduled calendar component (e.g. a VEVENT) to another calendar
user (sometimes called the delegate or delegatee). An example of
a delegator is a busy executive sending an employee to a meeting
in his or her place.
<span class="grey">Mahoney, et. al. Informational [Page 3]</span><span id="page-4" ></span>
<span class="grey"><a href="./rfc3283">RFC 3283</a> Guide to Internet Calendaring June 2002</span>
Delegate
A calendar user (sometimes called the delegatee) who has been
assigned to participate in a scheduled calendar component (e.g. a
VEVENT) in place of one of the attendees in that component
(sometimes called the delegator). An example of a delegate is a
team member sent to a particular meeting.
Designate
A calendar user authorized to act on behalf of another calendar
user. An example of a designate is an assistant scheduling
meetings for his or her superior.
Local Store
A CS that is on the same device as the CUA.
Property
A description of some element of a component, such as a start
time, title or location.
Remote Store
A CS that is not on the same device as the CUA.
<span class="h3"><a class="selflink" id="section-1.2" href="#section-1.2">1.2</a> Concepts and Relationships</span>
iCalendar is the language used to describe calendar objects. iTIP
describes a way to use the iCalendar language to do scheduling. iMIP
describes how to do iTIP scheduling via e-mail. CAP describes a way
to use the iCalendar language to access a calendar store in real-
time.
The relationship between calendaring protocols is similar to that
between e-mail protocols. In those terms, iCalendar is analogous to
<a href="./rfc2822">RFC 2822</a>, iTIP and iMIP are analogous to the Simple Mail Transfer
Protocol (SMTP), and CAP is analogous to the Post Office Protocol
(POP) or Internet Message Access Protocol (IMAP).
<span class="h2"><a class="selflink" id="section-2" href="#section-2">2</a>. Requirements</span>
<span class="h3"><a class="selflink" id="section-2.1" href="#section-2.1">2.1</a> Fundamental Needs</span>
The following scenarios illustrate people and organizations' basic
calendaring and scheduling needs:
<span class="grey">Mahoney, et. al. Informational [Page 4]</span><span id="page-5" ></span>
<span class="grey"><a href="./rfc3283">RFC 3283</a> Guide to Internet Calendaring June 2002</span>
a] A doctor wishes to keep track of all her appointments.
Need: To read and manipulate one's own calendar with only one CUA.
b] A busy musician wants to maintain her schedule with multiple
devices, such as through an Internet-based agenda and with a PDA.
Need: To read and manipulate one's own calendar, possibly with
solutions from different vendors.
c] A software development team wishes to more effectively schedule
their time through viewing each other's calendar information.
Need: To share calendar information between users of the same
calendar service.
d] A teacher wants his students to schedule appointments during
his office hours.
Need: To schedule calendar events, to-dos and journals with other
users of the same calendar service.
e] A movie theater wants to publish its schedule for prospective
customers.
Need: To share calendar information with users of other calendar
services, possibly from a number of different vendors.
f] A social club wants to schedule calendar entries effectively
with its members.
Need: To schedule calendar events and to-dos with users of other
calendar services, possibly from a number of different vendors.
<span class="h3"><a class="selflink" id="section-2.2" href="#section-2.2">2.2</a> Protocol Requirements</span>
Some of these needs can be met by proprietary solutions (a, c, d),
but others can not (b, e, f). These latter scenarios show that
standard protocols are required for accessing information in a
calendar store and scheduling calendar entries. In addition, these
protocols require a common data format for representing calendar
information.
These requirements are met by the following protocol specifications.
<span class="grey">Mahoney, et. al. Informational [Page 5]</span><span id="page-6" ></span>
<span class="grey"><a href="./rfc3283">RFC 3283</a> Guide to Internet Calendaring June 2002</span>
- Data format: iCalendar [<a href="./rfc2445" title=""Internet Calendaring and Scheduling Core Object Specification - iCalendar"">RFC-2445</a>]
iCalendar [<a href="./rfc2445" title=""Internet Calendaring and Scheduling Core Object Specification - iCalendar"">RFC-2445</a>] provides a data format for representing
calendar information, to be used and exchanged by other protocols.
iCalendar [<a href="./rfc2445" title=""Internet Calendaring and Scheduling Core Object Specification - iCalendar"">RFC-2445</a>] can also be used in other contexts, such as a
drag-and-drop interface, or an export/import feature. All the
other calendaring protocols depend on iCalendar [<a href="./rfc2445" title=""Internet Calendaring and Scheduling Core Object Specification - iCalendar"">RFC-2445</a>], so all
elements of a standards-based calendaring and scheduling systems
will have to be able to interpret iCalendar [<a href="./rfc2445" title=""Internet Calendaring and Scheduling Core Object Specification - iCalendar"">RFC-2445</a>].
- Scheduling protocol: iTIP [<a href="./rfc2446" title=""iCalendar Transport-Independent Interoperability Protocol (iTIP): Scheduling Events, Busy Time, To-dos and Journal Entries"">RFC-2446</a>]
iTIP [<a href="./rfc2446" title=""iCalendar Transport-Independent Interoperability Protocol (iTIP): Scheduling Events, Busy Time, To-dos and Journal Entries"">RFC-2446</a>] describes the messages used to schedule calendar
events. Within iTIP messages, events are represented in iCalendar
[<a href="./rfc2445" title=""Internet Calendaring and Scheduling Core Object Specification - iCalendar"">RFC-2445</a>] format, and have semantics that identify the message as
being an invitation to a meeting, an acceptance of an invitation,
or the assignment of a task.
iTIP [<a href="./rfc2446" title=""iCalendar Transport-Independent Interoperability Protocol (iTIP): Scheduling Events, Busy Time, To-dos and Journal Entries"">RFC-2446</a>] messages are used in the scheduling workflow,
where users exchange messages in order to organize things such as
events and to-dos. CUAs generate and interpret iTIP [<a href="./rfc2446" title=""iCalendar Transport-Independent Interoperability Protocol (iTIP): Scheduling Events, Busy Time, To-dos and Journal Entries"">RFC-2446</a>]
messages at the direction of the calendar user. With iTIP [RFC-
2446] users can create, modify, delete, reply to, counter, and
decline counters to the various iCalendar [<a href="./rfc2445" title=""Internet Calendaring and Scheduling Core Object Specification - iCalendar"">RFC-2445</a>] components.
Furthermore, users can also request the free/busy time of other
people.
iTIP [<a href="./rfc2446" title=""iCalendar Transport-Independent Interoperability Protocol (iTIP): Scheduling Events, Busy Time, To-dos and Journal Entries"">RFC-2446</a>] is transport-independent, and has one specified
transport binding: iMIP [<a href="./rfc2447" title=""iCalendar Message-Based Interoperability Protocol - iMIP"">RFC-2447</a>] binds iTIP to e-mail. In
addition [<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>] will provide a real-time binding of iTIP [RFC-
2446], allowing CUAs to perform calendar management and scheduling
over a single connection.
- Calendar management protocol: [<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>]
[<a id="ref-CAP">CAP</a>] describes the messages used to manage calendars on a
calendar store. These messages use iCalendar [<a href="./rfc2445" title=""Internet Calendaring and Scheduling Core Object Specification - iCalendar"">RFC-2445</a>] to
describe various components such as events and to-dos. These
messages make it possible to perform iTIP [<a href="./rfc2446" title=""iCalendar Transport-Independent Interoperability Protocol (iTIP): Scheduling Events, Busy Time, To-dos and Journal Entries"">RFC-2446</a>] operations,
as well as other operations relating to a calendar store such as
searching, creating calendars, specifying calendar properties, and
specifying calendar access rights.
<span class="grey">Mahoney, et. al. Informational [Page 6]</span><span id="page-7" ></span>
<span class="grey"><a href="./rfc3283">RFC 3283</a> Guide to Internet Calendaring June 2002</span>
<span class="h2"><a class="selflink" id="section-3" href="#section-3">3</a>. Solutions</span>
<span class="h3"><a class="selflink" id="section-3.1" href="#section-3.1">3.1</a> Examples</span>
Returning to the scenarios presented in <a href="#section-2.1">section 2.1</a>, the calendaring
protocols can be used in the following ways:
a] The doctor can use a proprietary CUA with a local store, and
perhaps use iCalendar [<a href="./rfc2445" title=""Internet Calendaring and Scheduling Core Object Specification - iCalendar"">RFC-2445</a>] as a storage mechanism. This
would allow her to easily import her data store into another
application that supports iCalendar [<a href="./rfc2445" title=""Internet Calendaring and Scheduling Core Object Specification - iCalendar"">RFC-2445</a>].
b] The musician who wishes to access her agenda from anywhere can
use a [<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>]-enabled calendar service accessible over the Internet.
She can then use any available [<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>] clients to access the data.
A proprietary system that provides access through a Web-based
interface could also be employed, but the use of [<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>] would be
superior in that it would allow the use of third party
applications, such as PDA synchronization tools.
c] The development team can use a calendar service which supports
[<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>], and each member can use a [<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>]-enabled CUA of their
choice.
Alternatively, each member could use an iMIP [<a href="./rfc2447" title=""iCalendar Message-Based Interoperability Protocol - iMIP"">RFC-2447</a>]-enabled
CUA, and they could book meetings over e-mail. This solution has
the drawback that it is difficult to examine other users' agendas,
making the organization of meetings more difficult.
Proprietary solutions are also available, but they require that
all members use clients by the same vendor, and disallow the use
of third party applications.
d] The teacher can set up a calendar service, and have students
book time through any of the iTIP [<a href="./rfc2446" title=""iCalendar Transport-Independent Interoperability Protocol (iTIP): Scheduling Events, Busy Time, To-dos and Journal Entries"">RFC-2446</a>] bindings. [<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>]
provides real-time access, but could require additional
configuration. iMIP [<a href="./rfc2447" title=""iCalendar Message-Based Interoperability Protocol - iMIP"">RFC-2447</a>] would be the easiest to configure,
but may require more e-mail processing.
If [<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>] access is provided then determining the state of the
teacher's schedule is straightforward. If not, this can be
determined through iTIP [<a href="./rfc2446" title=""iCalendar Transport-Independent Interoperability Protocol (iTIP): Scheduling Events, Busy Time, To-dos and Journal Entries"">RFC-2446</a>] free/busy requests. Non-
standard methods could also be employed, such as serving up
iCalendar [<a href="./rfc2445" title=""Internet Calendaring and Scheduling Core Object Specification - iCalendar"">RFC-2445</a>], HTML, or XML over HTTP.
A proprietary system could also be used, but would require that
all students be able to use software from a specific vendor.
<span class="grey">Mahoney, et. al. Informational [Page 7]</span><span id="page-8" ></span>
<span class="grey"><a href="./rfc3283">RFC 3283</a> Guide to Internet Calendaring June 2002</span>
e] [<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>] would be preferred for publishing a movie theater's
schedule, since it provides advanced access and search
capabilities. It also allows easy integration with customers'
calendar systems.
Non-standard methods such as serving data over HTTP could also be
employed, but would be harder to integrate with customers'
systems.
Using a completely proprietary solution would be very difficult,
if not impossible, since it would require every user to install
and use the proprietary software.
f] The social club could distribute meeting information in the
form of iTIP [<a href="./rfc2446" title=""iCalendar Transport-Independent Interoperability Protocol (iTIP): Scheduling Events, Busy Time, To-dos and Journal Entries"">RFC-2446</a>] messages, sent via e-mail using iMIP
[<a href="./rfc2447" title=""iCalendar Message-Based Interoperability Protocol - iMIP"">RFC-2447</a>]. The club could distribute meeting invitations, as
well as a full published agenda.
Alternatively, the club could provide access to a [<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>]-enabled
calendar service. However, this solution would be more expensive
since it requires the maintenance of a server.
<span class="h3"><a class="selflink" id="section-3.2" href="#section-3.2">3.2</a> Systems</span>
The following diagrams illustrate possible systems and their usage of
the various protocols.
<span class="h4"><a class="selflink" id="section-3.2.1" href="#section-3.2.1">3.2.1</a> Standalone Single-user System</span>
A single user system that does not communicate with other systems
need not employ any of the protocols. However, it may use iCalendar
[<a href="./rfc2445" title=""Internet Calendaring and Scheduling Core Object Specification - iCalendar"">RFC-2445</a>] as a data format in some places.
----------- O
| CUA w/ | -+- user
|local store| A
----------- / \
<span class="h4"><a class="selflink" id="section-3.2.2" href="#section-3.2.2">3.2.2</a> Single-user Systems Communicating</span>
Users with single-user systems may schedule meetings with each others
using iTIP [<a href="./rfc2446" title=""iCalendar Transport-Independent Interoperability Protocol (iTIP): Scheduling Events, Busy Time, To-dos and Journal Entries"">RFC-2446</a>]. The easiest binding of iTIP [<a href="./rfc2446" title=""iCalendar Transport-Independent Interoperability Protocol (iTIP): Scheduling Events, Busy Time, To-dos and Journal Entries"">RFC-2446</a>] to use
would be iMIP [<a href="./rfc2447" title=""iCalendar Message-Based Interoperability Protocol - iMIP"">RFC-2447</a>], since messages can be held in the users'
mail queues, which we assume to already exist. [<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>] could also be
used.
<span class="grey">Mahoney, et. al. Informational [Page 8]</span><span id="page-9" ></span>
<span class="grey"><a href="./rfc3283">RFC 3283</a> Guide to Internet Calendaring June 2002</span>
O ----------- ----------- O
-+- | CUA w/ | -----[iMIP]----- | CUA w/ | -+- user
A |local store| Internet |local store| A
/ \ ----------- ----------- / \
<span class="h4"><a class="selflink" id="section-3.2.3" href="#section-3.2.3">3.2.3</a> Single-user with Multiple CUAs</span>
A single user may use more than one CUA to access his or her
calendar. The user may use a PDA, a Web client, a PC, or some other
device, depending on accessibility. Some of these clients may have
local stores and others may not. Those with local stores need to
synchronize the data on the CUA with the data on the CS.
-----------
| CUA w | -----[<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>]----------+
|local store| |
O ----------- ----------
-+- | CS |
A | |
/ \ ----------
----------- |
| CUA w/o | -----[<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>]----------+
|local store|
-----------
<span class="h4"><a class="selflink" id="section-3.2.4" href="#section-3.2.4">3.2.4</a> Single-user with Multiple Calendars</span>
A single user may have many independent calendars; for example, one
may contain work-related information and another personal
information. The CUA may or may not have a local store. If it does,
then it needs to synchronize the data of the CUA with the data on
both of the CS.
----------
+------------[<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>]------ | CS |
| | |
O ----------- ----------
-+- | CUA |
A | |
/ \ -----------
| ----------
+------------[<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>]------ | CS |
| |
----------
<span class="grey">Mahoney, et. al. Informational [Page 9]</span><span id="page-10" ></span>
<span class="grey"><a href="./rfc3283">RFC 3283</a> Guide to Internet Calendaring June 2002</span>
<span class="h4"><a class="selflink" id="section-3.2.5" href="#section-3.2.5">3.2.5</a> Users Communicating on a Multi-user System</span>
Users on a multi-user system may schedule meetings with each other
using [<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>]-enabled CUAs and services. The CUAs may or may not have
local stores. Those with local stores need to synchronize the data
on the CUAs with the data on the CS.
O -----------
-+- | CUA w | -----[<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>]----------+
A |local store| |
/ \ ----------- ----------
| CS |
| |
----------
O ----------- |
-+- | CUA w/o | -----[<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>]----------+
A |local store|
/ \ -----------
<span class="h4"><a class="selflink" id="section-3.2.6" href="#section-3.2.6">3.2.6</a> Users Communicating through Different Multi-user Systems</span>
Users on a multi-user system may need to schedule meetings with users
on a different multi-user system. The services can communicate using
[<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>] or iMIP [<a href="./rfc2447" title=""iCalendar Message-Based Interoperability Protocol - iMIP"">RFC-2447</a>].
O ----------- ----------
-+- | CUA w | -----[<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>]-------| CS |
A |local store| | |
/ \ ----------- ----------
|
[<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>] or [iMIP]
|
O ----------- ----------
-+- | CUA w/o | -----[<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>]-------| CS |
A |local store| | |
/ \ ----------- ----------
<span class="h2"><a class="selflink" id="section-4" href="#section-4">4</a>. Important Aspects</span>
There are a number of important aspects of these calendaring
standards of which people, especially implementers, should be aware.
<span class="h3"><a class="selflink" id="section-4.1" href="#section-4.1">4.1</a> Timezones</span>
The dates and times in components can refer to a specific time zone.
Time zones can be defined in a central store, or they may be defined
by a user to fit his or her needs. All users and applications should
be aware of time zones and time zone differences. New time zones may
<span class="grey">Mahoney, et. al. Informational [Page 10]</span><span id="page-11" ></span>
<span class="grey"><a href="./rfc3283">RFC 3283</a> Guide to Internet Calendaring June 2002</span>
need to be added, and others removed. Two different vendors may
describe the same time zone differently (such as by using a different
name).
<span class="h3"><a class="selflink" id="section-4.2" href="#section-4.2">4.2</a> Choice of Transport</span>
There are issues to be aware of in choosing between a network
protocol such as [<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>], or a store and forward protocol, such as iMIP
[<a href="./rfc2447" title=""iCalendar Message-Based Interoperability Protocol - iMIP"">RFC-2447</a>].
The use of a network ("on-the-wire") mechanism may require some
organizations to make provisions to allow calendaring traffic to
traverse a corporate firewall on the required ports. Depending on
the organizational culture, this may be a challenging social
exercise.
The use of an email-based mechanism exposes time-sensitive data to
unbounded latency. Large or heavily utilized mail systems may
experience an unacceptable delay in message receipt.
<span class="h3"><a class="selflink" id="section-4.3" href="#section-4.3">4.3</a> Security</span>
See the "Security Considerations" (<a href="#section-6">Section 6</a>) section below.
<span class="h3"><a class="selflink" id="section-4.4" href="#section-4.4">4.4</a> Amount of data</span>
In some cases, a component may be very large, for instance, a
component with a very large attachment. Some applications may be
low-bandwidth or may be limited in the amount of data they can store.
Maximum component size may be set in [<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>]. It can also be
controlled in iMIP [<a href="./rfc2447" title=""iCalendar Message-Based Interoperability Protocol - iMIP"">RFC-2447</a>] by restricting the maximum size of the
e-mail that the application can download.
<span class="h3"><a class="selflink" id="section-4.5" href="#section-4.5">4.5</a> Recurring Components</span>
In iCAL [<a href="./rfc2445" title=""Internet Calendaring and Scheduling Core Object Specification - iCalendar"">RFC-2445</a>], one can specify complex recurrence rules for
VEVENTs, VTODOs, and VJOURNALs. One must be careful to correctly
interpret these recurrence rules and pay extra attention to being
able to interoperate using them.
<span class="h2"><a class="selflink" id="section-5" href="#section-5">5</a>. Open Issues</span>
Many issues are not currently resolved by these protocols, and many
desirable features are not yet provided. Some of the more prominent
ones are outlined below.
<span class="grey">Mahoney, et. al. Informational [Page 11]</span><span id="page-12" ></span>
<span class="grey"><a href="./rfc3283">RFC 3283</a> Guide to Internet Calendaring June 2002</span>
<span class="h3"><a class="selflink" id="section-5.1" href="#section-5.1">5.1</a> Scheduling People, not Calendars</span>
Meetings are scheduled with people; however, people may have many
calendars, and may store these calendars in many places. There may
also be many routes to contact them. The calendaring protocols do
not attempt to provide unique access for contacting a given person.
Instead, 'calendar addresses' are booked, which may be e-mail
addresses or individual calendars. It is up to the users themselves
to orchestrate mechanisms to ensure that the bookings go to the right
place.
<span class="h3"><a class="selflink" id="section-5.2" href="#section-5.2">5.2</a> Administration</span>
The calendaring protocols do not address the issues of administering
users and calendars on a calendar service. This must be handled by
proprietary mechanisms for each implementation.
<span class="h3"><a class="selflink" id="section-5.3" href="#section-5.3">5.3</a> Notification</span>
People often wish to be notified of upcoming events, new events, or
changes to existing events. The calendaring protocols do not attempt
to address these needs in a real-time system. Instead, the ability
to store alarm information on events is provided, which can be used
to provide client-side notification of upcoming events. To organize
notification of new or changed events, clients have to poll the data
store.
<span class="h2"><a class="selflink" id="section-6" href="#section-6">6</a>. Security Considerations</span>
<span class="h3"><a class="selflink" id="section-6.1" href="#section-6.1">6.1</a> Access Control</span>
There has to be reasonable granularity in the configuration options
for access to data through [<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>], so that what should be released to
requesters is released, and what shouldn't is not. Details of
handling this are described in [<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>].
<span class="h3"><a class="selflink" id="section-6.2" href="#section-6.2">6.2</a> Authentication</span>
Access control must be coupled with a good authentication system, so
that the right people get the right information. For [<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>], this
means requiring authentication before any database access can be
performed, and checking access rights and authentication credentials
before releasing information. [<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>] uses the Simple Authentication
Security Layer (SASL) for this authentication. In iMIP [<a href="./rfc2447" title=""iCalendar Message-Based Interoperability Protocol - iMIP"">RFC-2447</a>],
this may present some challenges, as authentication is often not a
consideration in store-and-forward protocols.
<span class="grey">Mahoney, et. al. Informational [Page 12]</span><span id="page-13" ></span>
<span class="grey"><a href="./rfc3283">RFC 3283</a> Guide to Internet Calendaring June 2002</span>
Authentication is also important for scheduling, in that receivers of
scheduling messages should be able to validate the apparent sender.
Since scheduling messages are wrapped in MIME [<a href="./rfc2045" title=""Multipurpose Internet Mail Extensions (MIME) - Part One: Format of Internet Message Bodies"">RFC-2045</a>], signing and
encryption are freely available. For messages transmitted over mail,
this is the only available alternative. It is suggested that
developers take care in implementing the security features in iMIP
[<a href="./rfc2447" title=""iCalendar Message-Based Interoperability Protocol - iMIP"">RFC-2447</a>], bearing in mind that the concept and need may be foreign
or non-obvious to users, yet essential for the system to function as
they might expect.
The real-time protocols provide for the authentication of users, and
the preservation of that authentication information, allowing for
validation by the receiving end-user or server.
<span class="h3"><a class="selflink" id="section-6.3" href="#section-6.3">6.3</a> Using E-mail</span>
Because scheduling information can be transmitted over mail without
any authentication information, e-mail spoofing is extremely easy if
the receiver is not checking for authentication. It is suggested
that implementers consider requiring authentication as a default,
using mechanisms such as are described in <a href="#section-3">Section 3</a> of iMIP [RFC-
2447]. The use of e-mail, and the potential for anonymous
connections, means that 'calendar spam' is possible. Developers
should consider this threat when designing systems, particularly
those that allow for automated request processing.
<span class="h3"><a class="selflink" id="section-6.4" href="#section-6.4">6.4</a> Other Issues</span>
The current security context should be obvious to users. Because the
underlying mechanisms may not be clear to users, efforts to make
clear the current state in the UI should be made. One example of
this is the 'lock' icon used in some Web browsers during secure
connections.
With both iMIP [<a href="./rfc2447" title=""iCalendar Message-Based Interoperability Protocol - iMIP"">RFC-2447</a>] and [<a href="#ref-CAP" title=""Calendar Access Protocol (CAP)"">CAP</a>], the possibilities of Denial of
Service attacks must be considered. The ability to flood a calendar
system with bogus requests is likely to be exploited once these
systems become widely deployed, and detection and recovery methods
will need to be considered.
Acknowledgments
Thanks to the following, who have participated in the development of
this document:
Eric Busboom, Pat Egen, David Madeo, Shawn Packwood, Bruce Kahn,
Alan Davies, Robb Surridge.
<span class="grey">Mahoney, et. al. Informational [Page 13]</span><span id="page-14" ></span>
<span class="grey"><a href="./rfc3283">RFC 3283</a> Guide to Internet Calendaring June 2002</span>
References
[<a id="ref-RFC-2445">RFC-2445</a>] Dawson, F. and D. Stenerson, "Internet Calendaring and
Scheduling Core Object Specification - iCalendar", <a href="./rfc2445">RFC</a>
<a href="./rfc2445">2445</a>, November 1998.
[<a id="ref-RFC-2446">RFC-2446</a>] Silverberg, S., Mansour, S., Dawson, F. and R. Hopson,
"iCalendar Transport-Independent Interoperability Protocol
(iTIP): Scheduling Events, Busy Time, To-dos and Journal
Entries", <a href="./rfc2446">RFC 2446</a>, November 1998.
[<a id="ref-RFC-2447">RFC-2447</a>] Dawson, F., Mansour, S. and S. Silverberg, "iCalendar
Message-Based Interoperability Protocol - iMIP", <a href="./rfc2447">RFC 2447</a>,
November 1998.
[<a id="ref-RFC-2045">RFC-2045</a>] Freed, N. and N. Borenstein, "Multipurpose Internet Mail
Extensions (MIME) - Part One: Format of Internet Message
Bodies", <a href="./rfc2045">RFC 2045</a>, November 1996.
[<a id="ref-CAP">CAP</a>] Mansour, S., Royer, D., Babics, G., and Hill, P.,
"Calendar Access Protocol (CAP)", Work in Progress.
<span class="grey">Mahoney, et. al. Informational [Page 14]</span><span id="page-15" ></span>
<span class="grey"><a href="./rfc3283">RFC 3283</a> Guide to Internet Calendaring June 2002</span>
Authors' Addresses
Bob Mahoney
MIT
E40-327
77 Massachusetts Avenue
Cambridge, MA 02139
US
Phone: (617) 253-0774
EMail: [email protected]
George Babics
Steltor
2000 Peel Street
Montreal, Quebec H3A 2W5
CA
Phone: (514) 733-8500 x4201
EMail: [email protected]
Alexander Taler
EMail: [email protected]
<span class="grey">Mahoney, et. al. Informational [Page 15]</span><span id="page-16" ></span>
<span class="grey"><a href="./rfc3283">RFC 3283</a> Guide to Internet Calendaring June 2002</span>
Full Copyright Statement
Copyright (C) The Internet Society (2002). All Rights Reserved.
This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
English.
The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement
Funding for the RFC Editor function is currently provided by the
Internet Society.
Mahoney, et. al. Informational [Page 16]
Annotations
Select text to annotate