potentially serious Exchange interop issue

[schvenk]

I've tripped over a potentially serious - and definitely embarrassing - issue in the interop between Zimbra and Exchange. The short short summary is that via a Zimbra server you can accidentally delete other people's meetings on the Exchange server.

My company has some users on Exchange for email/calendar, and some on IMAP with no server-based calendar. I'm on IMAP. So, I set up my own local Zimbra install to help with calendaring and keep things synced across multiple Macs. I was using a combination of Leopard iCal with CalDAV, and Thunderbird with Lightning nightly builds, again taking advantage of CalDAV. Here's what happened:

1. Our VP set up a meeting on Exchange and invited my manager.

2. My manager forwarded me the meeting info as a .ics attachment. As far as I can tell it was described in the .ics as a regular event rather than an invite (that is, no acceptance necessary). A peek at the .ics source reveals that the meeting originator was still in there, though.

3. I received the email in Thunderbird.

3. I added it (that is, the .ics attachment) to my Zimbra calendar via CalDAV using Leopard iCal. Again, it wasn't an invite so I didn't need to accept or anything.

4. I accidentally deleted the event, again in iCal. The Zimbra server sent cancellation notices to every attendee, even though it wasn't my meeting.

5. Exchange accepted the cancellations, and either deleted the meeting from everyone's calendars or marked it as canceled.

The unfortunate result was that despite my apologetic email to everyone involved, several people didn't show because the meeting was no longer on their calendars. Everyone's been good-natured but still, messy and kinda embarrassing.

I presume that this sort of thing might be possible with larger Zimbra installations too. I'm unlikely to use my Zimbra calendar while a stray keystroke could result in canceling other people's meetings (and have shut off my local server for the moment).

Anyway, though it was worth reporting.

[jholder]

This is a plausible scenario. It has nothing to do with exchange interop though. It's an issue of how CalDAV clients should behave when importing ics files where the you are neither an organizer or attendee.

It appears Thunderbird assumed you were the organizer of the meeting when importing an ics in the email attachment, therefore when you later canceled the meeting it sent out erroneous cancellation notices to the attendees.

Thunderbird should have prompted you when the meeting was deleted whether to send the cancellation message to the attendees, and if it did you might have clicked ok.

If this indeed happened, it's a serious issue for sure. But it has nothing to do with exchange interop, and more of a general CalDAV client problem, and not specific to Zimbra server.

We're going to CalDav next week to talk with people like Mozilla, Apple, etc. I'll bring it up.

[schvenk]

For the record, the actual cancellation action occurred in iCal. So I read the email in Thunderbird, opened the ICS attachment in iCal, and then deleted in iCal.

As I'm sure you know, iCal's invite flow is awful. A bunch of half-baked AppleScripts. I have vague dreams of writing better ones in my spare time (hah).