I'd like to flush out some distinctions between client side and server- side behaviours. Lets say I want to have the CalenderServer permit a group of people to share write privileges on each others calenders. If I want the server to permit this, I have to have a way to tell the server to let this happen. That points towards either an LDAP, an Open Directory, an XML or an apache groups/passwd or digest model of activity at client connect time. no? (Its interesting to ask if there is any UI, commandline, or web, which could allow me to control this outside of a calendering client. Is it only instantiated by groups existences in the Directory bound to the server? is it only activated if a CalDAV event happens driven by a client?) Client-side, I have to manage this in-client, at calender subscription time and also in the accounts management phase (at least, as instantiatedby iCal client) These two things are disjoint. The client has to have a way to say "give group permissions to my (sub)calender <x>" and the server has to have a way to enforce it, and they meet in the Directory: but only if the client and the server share the same directory. Obviously, the ideal is to share the directory. But the reality is, the directory is very probably not public, and also since its Open Directory, its not actually that reachable for all clients out there. This seems like a major mismatch. What have I misunderstood? Why is this so complicated? -Maybe, the only good answer is "because" but its a bit worrying for calender management. -G