Subject: Calendar Access Rights Proposal Update

From: "Frank Dawson" <[email-masked]>
Date: Mon, 8 Feb 1999 23:26:30 -0500

Folks:

Before the Holidays, Doug Royer posted a preliminary draft of a proposal for
calendar access rights (CAR) for CAP. Here is an update to that proposal.
These changes reflect some renaming of the elements. It also reflects a
thought that what we are trying to specify is "calendar access", not to be
confused with other possible uses of the term "ACL" in the computer
industry. The proposal also specifies how a small set of standard calendar
access "policies" can be specified.

- - Frank Dawson

Network Working Group            Frank Dawson, Lotus
Internet Draft                Doug Royer, Sun
<CAP CAR Proposal-01.txt>
Expires six months after:                      February 8, 1999

                   CAP Calendar Access Rights Proposal

Abstract

   This memo is a proposal for calendar access rights (CAR) for the
   Calendar Access Protocol (CAP). Calendar access rights specify what
   an authenticated calendar user can and can not do within a particular
   calendar store and the underlying calendars. CAR are necessary within
   CAP in order to define a secure Internet calendar access protocol.

1.      Introduction

   This is a proposal for specifying a mechanism for calendar access
   rights within CAP. The proposal extends the functionality defined in
   [RFC 2445] by adding a "VCAR" calendar component, "RIGHTS" value type
   and the "GRANT", "DENY" and "CARID" component properties.

   Individual calendar access rights MUST be specifically granted to an
   authenticated calendar user; all rights are denied unless
   specifically granted.

   Properties within an iCalendar object are unordered. This also is the
   case for the "GRANT", "DENY" and "CARID" properties. Likewise, there
   is no implied ordering required for components of a "RIGHTS" value
   type other than that specified by the ABNF.

2.      Capability

   Support for the Calendar Access Rights feature can be discovered by
   issuing a CAPABILITIES command to a CAP server. If a CAP server
   supports the Calendar Access Rights, then the reply would include the
   text "CAR". If the reply does not contain the text "CAR", then the
   CAP server does not support the creation, retrieval, deletion or
   modification of Calendar Access Rights.

3.      CAR Inheritance

   Calendar access rights specified in a calendar store are inherited as
   default calendar access rights for any calendar in the parent
   calendar store. Likewise, any calendar access rights specified in a
   root calendar are inherited as default calendar access rights for any
   sub-calendar to the root calendar. By implication, calendar access
   rights specified in a sub-calendar are inherited as default calendar
   access rights for any calendars that are hierarchically below the sub-
   calendar.

   Calendar access rights specified in a calendar override any default
   calendar access rights. Calendar access rights specified within a sub-
   calendar override any default calendar access rights.

4.      RIGHTS Value Type

   Value Name: RIGHTS

   Purpose: This value type is used to identify properties whose value
   is a calendar access rights.

   Formal Definition: The value type is defined by the following
   notation:

   rights  = [caluser] (policy / carref / cardef) CRLF

   caluser = "CALUSER" "=" (text / all / "OWNER" / "NONOWNER")

   policy  = ";" "POLICY" "=" policyname

   policyname      = "READBUSYTIMEINFO" / "ACTONBEHALFOF" /
   "REQUESTONLY"
                   / "UPDATEPARTSTATUS" / "OWNER" / iana-name

   carref  = ";" "CARREF" "=" text *("," text)

   cardef  = action object

   action  = ";" "ACTION" "=" act-type *("," act-type)

   act-type        = ("CREATE" / "MODIFY" / "DELETE" / "READ" / all)

   object  = ";" "OBJECT" "=" (csprop *("," csprop) [propvalue])
                   / (calprop *("," calprop) [propvalue])
                   / (component *("," component)) [compvalue]
                   / (compprop *("," compprop) [propvalue])
                   / (compparam *("," compparam) [paramvalue])

   csprop  = csprop2 / all / iana-name

   csprop2 = <any calendar store property defined in [CAP]>

   propvalue       = propvalue2 / all / iana-name

   propvalue2      = <any value appropriate for the named property>

   calprop = calprop2 / all/ iana-name

   calprop2        = <any calendar property name defined in [ICAL] or
                     [CAP]>

   component       = component2 / all /iana-name

   component2      = <any calendar component defined in [ICAL] or [CAP]>

   compprop        = compprop2 / all /iana-name

   compprop2       = <any component property name defined in [ICAL] or
                     [CAP]>

   compparam       = compparm2 / all / iana-name

   compparm2       = <any component parameter name defined in [ICAL] or
                     [CAP]>

   compvalue       = ";" "VALUE" "=" ((component2 *("," component2))
                / all / iana-name)

   paramvalue      = paramvalue2 / all / iana-name

   paramvalue2     = <any value appropriate for the named parameter>

   all             = "ALL"

   iana-name       = <A name registered with IANA>

   Description: The value type is a structured value consisting of a
   list of one or more access control rights rule parts. Each rule part
   is defined by a "NAME=VALUE" pair. The rule parts are separated from
   each other by the SEMICOLON character (US-ASCII decimal 59). The rule
   parts are not ordered in any particular sequence, unless otherwise
   specified by the ABNF. Individual rule parts MUST only be specified
   once.

   The CALUSER rule part specifies the authenticated calendar user that
   the calendar access rights applies to. If "ALL", then the rule
   applies to all authenticated calendar users. If "OWNER", then the
   rule applies to the owner of the calendar store or calendar. If
   "NONOWNER", then the rule applies to an authenticated calendar user
   that is not the owner of the calendar store or calendar. If this rule
   part is not specified in the value, then the calendar access rights
   do not apply to any authenticated calendar user. In this case, the
   calendar access rights can be defined for reference by another
   instance of a calendar access rights. For example, a complex set of
   calendar access rights can be defined once and referenced many times
   in the rights specified for individual calendar users.

   The POLICY rule part specifies a standard calendar access policy.
   Calendar access policies are individual sets of well-defined calendar
   access rights that can be referenced by their policy name.

        NOTE: Possible calendar access policy that may be standardized
        by CAP include:

        READBUSYTIMEINFO - Specifies rights for reading busy time data.

        ACTONBEHALFOF - Specifies rights for any CAP function taken on
        PUBLIC or PRIVATE calendar components. However, no CAP function
        can be taken on CONFIDENTIAL classified calendar components.

        REQUESTONLY - Specifies rights for creating new event
        invitations, to-do assignments and journal entries.

        UPDATEPARTSTATUS - Specifies rights for modifying ones own
        participation status.

        OWNER - Specifies the same rights given to the owner of the
        calendar store or calendar.

   The CARREF rule part specifies a reference to a particular "VCAR"
   calendar component. The text is matched to a CARID property value
   within a "VCAR" calendar component. This allows for a particular set
   of calendar access rights to be defined once and referenced multiple
   times. The "VCAR" identifier specified by this rule part is unique to
   the calendar store.

   The ACTION rule part defines one or more CAP actions that are allowed
   for the CALUSER. The valid values are CREATE, MODIFY, DELETE, READ,
   ALL. Multiple ACTION enumerations can be specified as a COMMA
   character (US-ASCII decimal 44) separated list of ACTION enumerated
   values. The text ALL is the same as specifying the enumerated values
   "CREATE, MODIFY, DELETE, READ".

   The OBJECT rule part defines the calendar store property, calendar
   property, calendar component, component property, or parameter that
   the ACTION is restricted to. Multiple OBJECT enumerations can be
   specified as a COMMA character (US-ASCII decimal 44) separated list
   of OBJECT enumerated values. The value ALL specifies any and all
   valid objects.

   The VALUE rule part specifies the restricted values for the OBJECT
   rule part. Multiple VALUE strings can be specified as a COMMA
   character (US-ASCII decimal 44) separated list of VALUE strings. The
   text ALL specifies any and all valid values. If an OBJECT rule part
   is specified but no corresponding VALUE rule part is specified, then
   the rule applies to any and all valid values of the specified
   OBJECT(s).

   Example: The following is a rule which specifies access rights for
   "foo" calendar user to read busy time values:

   CALUSER="foo";ACTION=READ;OBJECT=DTSTART,DTEND

5.      VCAR Calendar Component

   Component Name: "VCAR"

   Purpose: Provide a grouping of calendar access rights.

   Format Definition: A "VCAR" calendar component is defined by the
   following notation:

   aclc    = "BEGIN" ":" "VCAR" CRLF
                     carprop
             "END" ":" "VCAR" CRLF

   carprop = carid 1*(grant / deny)

   Description: A "VCAR" calendar component is a grouping of calendar
   access rights component properties.

   The "CARID" property specifies the local identifier for the "VCAR"
   calendar component. The "GRANT" property specifies calendar access
   rights granted to an authenticated calendar user. The "DENY" property
   specifies calendar access rights denied from an authenticated
   calendar user.

   Example: In the following example, the user "guest" has read access
   to the "DTSTART" and "DTEND" calendar components. No other access is
   specified:

   BEGIN:VCAR
   CARID:"View Start and End Times"
   GRANT:CALUSER="guest";ACTION="READ";OBJECT=DTSTART,DTEND
   END:VEVENT

   In this example, all users are given read access to "DTSTART" and
   "DTEND". "All users" is specified by the CALUSER value "ALL". Note
   that this enumerated CALUSER value is not in quotes.:

   BEGIN:VCAR
   CARID:"View Start and End Times 2"
   GRANT:CALUSER=ALL;ACTION=READ;OBJECT=DTSTART,DTEND
   END:VCAR

   In this example, rights are specified for all users to read
   components classified as PUBLIC:

   BEGIN:VCAR
   CARID:"View PUBLIC Start and End Times"
   GRANT:CALUSER=ALL;ACTION=READ;OBJECT=DTSTART;DTEND
   DENY:CALUSER=ALL;ACTION=READ;OBJECT=CLASS;VALUE=PRIVATE,
    CONFIDENTIAL
   END:VCAR

   In this example, rights are specified for all users to read or modify
   existing components classified as PUBLIC:

   BEGIN:VCAR
   CARID:"Read and Modify PUBLIC Calendar Entries"
   GRANT:CALUSER=ALL;ACTION=READ,MODIFY;OBJECT=ALL
   DENY:CALUSER=ALL;ACTION=READ,MODIFY;OBJECT=CLASS;VALUE=PRIVATE,
    CONFIDENTIAL
   END:VCAR

   In this example, rights are given to a standard calendar access right
   policy of "viewing" (i.e., READ) busy time information:

   BEGIN:VCAR
   CARID:"View Busy Time Information"
   GRANT:CALUSER=ALL;POLICY=READBUSYTIMEINFO
   END:VCAR

   In this example, full calendar access rights are given to the OWNER
   and a hypothetical administrator is given access rights to specify
   calendar access rights. If no other rights are specified, only these
   two authenticated calendar users can specify calendar access rights:

   BEGIN:VCAR
   CARID:"Only OWNER or ADMIN Settable CARs"
   GRANT:CALUSER=OWNER;ACTION=ALL;OBJECT=ALL
   GRANT:CALUSER="cal-admin";ACTION=ALL;OBJECT=VCAR,CARID,GRANT,DENY
   END:VCAR

   In this example, rights to create, read, modify or delete calendar
   access rights are denied to all authenticated calendar users. This
   example would disable providing different access rights to the
   calendar store or calendar. This calendar access rights should not be
   specified, as they the ability to change calendar access; even for
   the owner or administrator:

   BEGIN:VCAR
   CARID:"No CAR At All"
   DENY:CALUSER=ALL;OBJECT=VCAR,CARID,GRANT,DENY

6.      GRANT Component Property

   Property Name: GRANT

   Purpose: This property specifies those access rights granted to an
   authenticated calendar user.

   Value Type: RIGHTS

   Property Parameters: Only non-standard property parameters can be
   specified on this property.

   Conformance: This property can only be specified in  "VCAR" calendar
   component.

   Description: This property is used to grant calendar access rights to
   an authenticated calendar user.

   Format Definition: The property is defined by the following notation:

   grant   = "GRANT" rightsparam ":" rights CRLF
   rightparam      = *(";" xparam)

   Example: In the following example, a hypothetical "guest"
   authenticated calendar user is granted rights to view busy time
   information. These rights are specified by referencing a standard
   calendar access rights policy, by name:

   GRANT:CALUSER="guest";POLICY="READBUSYTIMEINFO"

7.      DENY Component Property

   Property Name: DENY

   Purpose: This property specifies those access rights denied from an
   authenticated calendar user.

   Value Type: RIGHTS

   Property Parameters: Only non-standard property parameters can be
   specified on this property.

   Conformance: This property can only be specified in  "VCAR" calendar
   component.

   Description: This property is used to deny calendar access rights to
   an authenticated calendar user.

   Format Definition: The property is defined by the following notation:

   DENY    = "DENY" rightsparam ":" rights CRLF
   rightparam      = *(";" xparam)

   Example: In the following example, any authenticated calendar user
   who is not the owner is denied rights to create, modify or delete
   entries:

   DENY:CALUSER=NONOWNER;ACTION=CREATE,MODIFY,DELETE;OBJECT=ALL

8.      VCAR Identifier Component Property

   Property Name: CARID

   Purpose: This property specifies the identifier for a "VCAR" calendar
   component.

   Value Type: TEXT

   Property Parameters: Non-standard property parameters can be
   specified on this property.

   Conformance: This property can be specified in "VCAR" calendar
   component.

   Description: This property permits previously defined sets of
   calendar access rights to be specified with a reference. This
   capability facilitates repetitively specifying calendar access
   rights.

   Format Definition: The property is defined by the following notation:

   CARID   = "CARID" textparam ":" text CRLF

   Example: The following is an example of this property:

   CARID:"Restrict Guests From Creating ALARMs On Events"