Using a group calendar via ical from caldav server

This post helps me much about setting up the iCal Server in my company.
I only want one more thing ... 😉

To get read only acces to the calender in ical (subscribe). So i can get the office secretariat to add appointment and the rest of the office can read only.

We can do it from the website, but it would very usefull to get it in iCal.
When i set up a subscribe to account i get the message i can't login with these account information.

I have also been trying to figure out how to grant some group users read-write and some group users read-only access to the same calendar via CalDAV, with little success. Any tips?

Haven't tried /used the groupcalendar functionality yet (might try it now with this "tutorial").

But for separate delegated users, leaving a user "unticked" for a calendar makes it only readable for that user.

Could a groupcalendar have 2 separate groups attatched with one "unticked"?

This was a major breakthrough discussion and saved our iCal server deployment. Thank you! The group calendars are working very well for basic read and write by members.

However, I continue to get an error when trying to invite someone to the event (for example, a person who is not a member of the group). We are not using the server as our mail server, so I've ensured that the user has an email address in their record on the server, which is also correctly populating in my Directory app. When I type the user's name into the invite area of the event, it auto-populates with the correct email address. I click the send button and then get this error returned:

Request Error

Access to "New Test Event" in "Workgroup Calendar" in account "WorkgroupTest" is not permitted.

The server responded:
"HTTP/1.1 403 Forbidden"
to operation CalDAVScheduleEventQueueableOperation.

Are others having success with invitations, or is this commonplace?

I get the exact same error message. We too are unable to "invite" users with external email addresses even though they are registered users and members of the Group. Has anyone found a way to do this?

A user who is "Subscribed" can read only. A user who creates a calendar via preferences as explained above in this thread will have read/write access.

I'm having trouble isolating the exact error(s) related to this, but here are some seemingly relevant lines from the logs. 'brainstimulationadministration' is the group that should have access to the location and that owns the calendar I'm adding the event to. 'magstimlab5100b' is the location I'm trying to assign for the event.

---

2008-04-24 16:29:08-0400 [-] [caldav-8009] [AMP,client] PROPFIND /calendars/locations/magstimlab5100b/ HTTP/1.1
2008-04-24 16:29:08-0400 [-] [caldav-8010] [AMP,client] PROPFIND /calendars/groups/brainstimulationadministration/inbox/ HTTP/1.1
2008-04-24 16:29:08-0400 [-] [caldav-8009] [AMP,client] PROPFIND /calendars/locations/magstimlab5100b/calendar/ HTTP/1.1
2008-04-24 16:29:08-0400 [-] [caldav-8009] [AMP,client] PROPFIND /calendars/locations/magstimlab5100b/inbox/ HTTP/1.1
2008-04-24 16:31:24-0400 [-] [caldav-8009] [AMP,client] PUT /calendars/groups/brainstimulationadministration/calendar/C5CDDCF3-4519-4A3F-96 D3-8C3A1748D58A.ics HTTP/1.1
2008-04-24 16:31:24-0400 [-] [caldav-8009] [-] Writing to file /Library/CalendarServer/Documents/calendars/groups/brainstimulationadministrati on/calendar/C5CDDCF3-4519-4A3F-96D3-8C3A1748D58A.ics

---

Should I start a new thread for this, given that this one is now marked 'answered'?

Greg

The solution is to make the user a "delegate" of the Group. Then go into their account settings under the Delegation tab in the Accounts I Can Access section, click the checkbox next to the group name.

This still strikes me as ludicrous. "We only designed it for Web and Wiki use!" Yet...Apple makes iCal, and as long as you're not doing invites or attaching files, it works absolutely wonderful when you add group calendar accounts to client machines.

Boggles. The. Mind.

Now that I've figured out the Delegate Trick, I'm rolling this out in production use amongst 25 or so users. We've been using it in production for a week and a half now with no problems whatsoever, and now that we're venturing into invites and attachments we'll need to do the Delegate Workaround.

I really hate how they notice people using it how you would expect a Group Calendar to be used (i.e. your company makes iCal Server and they, gasp, use iCal to access it), and then try to tell you that you're "using it wrong."

No, I believe it is Apple who may, perhaps, be recognizing how the rest of the world wants to use their products.

how do you setup a user as a delegate for a group? i haven't seen a way so far.

okay, i guess i found the answer.

first add the user's account.

then add the group calendar in the delegates area and show it.

it should just pop up. not sure why i missed that with all the exhaustive documentation…

Hi Folks,

Here is what i did to have a group calendar workable in Cal for somw to write and others just read.

First of all i disbaled the automatic url completion for all accounts in the clients iCal prefPanes, and used manually adresses. With that turned off u can use multiple Accounts on the same server with the same Password and User. And you can do it from an iCal Client, not from the server!

The URL for a User account is

http://your.server.com:8008/principals/users/username/ respectively for SSL https://your.server.com/principals/users/username/
Mind the trailing slahes

For groups the URL is like
http://your.server.com:8008/principals/groups/groupname/
or
https://your.server.com:8443/principals/groups/groupname/

ususally any user user of the group should be able to get access with read and write to this by setting up iCal this way. But we want to specify rights ... so we dont tell them.
Instead open the delegations panel for the group account (Button in the lower right) and delegate the calendar to every group member , set write access on for those who shall be able to write.

You are Done. With setting up the group Calendar for the Group, they only have to turn it on in the delegations panel of their own account to see it. Don’t forget to dlegate the Clendar to your self!

Once you have set it up, you can delete the Group Account from your iCal Client, as from now on you find the Group Calendar as a delegated Calendar.

This doesn’t work for very large groups or people who often need to change groups though, as it still needs to much handy work.

The Other Option would be to restrict Access to editing things in the Directory.app. You can specify for each group, which members are in it, and which of those members have read only access to Wiki, Blog, and Calendar, and which members have read and write access. But that means binding the ability to edit Wiki and Blog entries with the possibility to edit Calendars.


Which of the 2 Solutions might suite you better i cant tell, we use a mix.

If any thing written doenst get clear enough, please ask. I will try to explain again. (And sorry for all the germanisms)