[CalendarServer-dev] How to 'enable' locations and resources for OD configuration

From reading cachingappleopendirectory.py (and looking through the debug log), if the resource/location isn't already in the memcache, it queries DirectoryServices for the matching recordname (which it finds), but then it appears to check if the resource/location is part of the restrictedgroup (which I have configured). Since resource/location have no group attribute, this always fails. Or am I misunderstanding how this works? Eli