Hi Andre, thanks for your reply.
The only immediate answer I have is the service-wide caldavd.plist setting:
EnableReadOnlyServer
When set to true, nothing is writable.
Since the server hosts also calendards and other address books that must be writable to all principals, this would not be a solution. But maybe - as a workaround - one could set up a second, read-only server and transparently replicate / pull any changes from the first (read/write) one? It then would be possible to configure the read-only server for some users and the main server for others. Did anyone implement such a setup? Is there some documentation or HOWTO available?
There may be another option in the future, as we have been developing more stuff around shared address book collections, however we haven't yet had a release with any of those features. Also I don't believe there is any client support anywhere for managing shared address books, although that doesn't mean you can't use the feature(s), it just means you have to hand-craft some requests to manage the sharing state.
I'm afraid this won't be possible without some documentation. Currently, the lack of (at least a little) more comprehensive docs is _the_ major obstacle in implementing the open source DCS in production environments. Obviously, this is an (intended) point for buying OS X server ;-). Carsten