]> Apple Inc.

1 Infinite Loop Cupertino CA 95014 USA cyrus@daboo.name http://www.apple.com/

Fastmail US LLC

1429 Walnut St, Suite 1201 Philadephia PA 19102 USA murch@fastmailteam.com http://www.fastmail.com/

Applications alarms calendaring iCalendar CalDAV This document defines a set of extensions to the iCalendar VALARM component to enhance use of alarms and improve interoperability between clients and servers. This document updates RFC5545.

The iCalendar specification defines a set of components used to describe calendar data. One of those is the "VALARM" component which appears as a sub-component of "VEVENT" and "VTODO" components. The "VALARM" component is used to specify a reminder for an event or task. Different alarm actions are possible, as are different ways to specify how the alarm is triggered. As iCalendar has become more widely used and as client-server protocols such as CalDAV have become more prevalent, several issues with "VALARM" components have arisen. Most of these relate to the need to extend the existing "VALARM" component with new properties and behaviors to allow clients and servers to accomplish specific tasks in an interoperable manner. For example, clients typically need a way to specify that an alarm has been dismissed by a calendar user, or has been "snoozed" by a set amount of time. To date, this has been done through the use of custom "X-" properties specific to each client implementation, leading to poor interoperability. This specification defines a set of extensions to "VALARM" components to cover common requirements for alarms not currently addressed in iCalendar. Each extension is defined in a separate section below. For the most part, each extension can be supported independently of the others, though in some cases one extension will require another. In addition, this specification describes mechanisms by which clients can interoperably implement common features such as "snoozing".

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here. When XML element types in the namespaces "DAV:" and "urn:ietf:params:xml:ns:caldav" are referenced in this document outside of the context of an XML fragment, the string "DAV:" and "CALDAV:" will be prefixed to the element type names respectively.

Section 3.6.6 of defines the syntax for "VALARM" components and properties within them. However, as written, it is hard to extend this by adding, e.g., a new property common to all types of alarm. Since many of the extensions defined in this document need to extend the base syntax, an alternative form for the base syntax is defined here, with the goal of simplifying specification of the extensions while augmenting the existing functionality defined in to allow for nested sub-components (as required by proximity alarm triggers). A "VALARM" calendar component is re-defined by the following notation:

This extension adds a "UID" property to "VALARM" components to allow a unique identifier to be specified. The value of this property can then be used to refer uniquely to the "VALARM" component. The "UID" property defined here follows the definition in Section 3.8.4.7 of with the security and privacy updates in Section 5.3 of . In particular it MUST be a globally unique identifier that does not contain any security- or privacy-sensitive information. The "VALARM" component defined in is extended here as:

It is often convenient to relate one or more "VALARM" components to other "VALARM" components (e.g., see ). This can be accomplished if the "VALARM" components each have their own "UID" property (as per ). This specification updates the usage of the "RELATED-TO" property defined in Section 3.8.4.5 of to enable its use with "VALARM" components. Specific types of relationships between "VALARM" components can be identified by registering new values for the "RELTYPE" property parameter defined in Section 3.2.15 of . The "VALARM" component defined in is extended here as:

There is currently no way for a "VALARM" component to indicate whether it has been triggered and acknowledged. With the advent of a standard client/server protocol for calendaring and scheduling data () it is quite possible for an event with an alarm to exist on multiple clients in addition to the server. If each of those is responsible for performing the action when an alarm triggers, then multiple "alerts" are generated by different devices. In such a situation, a calendar user would like to be able to "dismiss" the alarm on one device and have it automatically dismissed on the others too. Also, with recurring events that have alarms, it is important to know when the last alarm in the recurring set was acknowledged, so that the client can determine whether past alarms have been missed. To address these needs, this specification adds an "ACKNOWLEDGED" property to "VALARM" components to indicate when the alarm was last acknowledged (or sent, if acknowledgement is not possible). This is defined by the syntax below.

ACKNOWLEDGED This property specifies the UTC date and time at which the corresponding alarm was last sent or acknowledged. DATE-TIME IANA and non-standard property parameters can be specified on this property. This property can be specified within "VALARM" calendar components. This property is used to specify when an alarm was last sent or acknowledged. This allows clients to determine when a pending alarm has been acknowledged by a calendar user so that any alerts can be dismissed across multiple devices. It also allows clients to track repeating alarms or alarms on recurring events or to-dos to ensure that the right number of missed alarms can be tracked. Clients SHOULD set this property to the current date-time value in UTC when a calendar user acknowledges a pending alarm. Certain kinds of alarms, such as email-based alerts, might not provide feedback as to when the calendar user sees them. For those kinds of alarms, the client SHOULD set this property when the alarm is triggered and the action successfully carried out. When an alarm is triggered on a client, clients can check to see if an "ACKNOWLEDGED" property is present. If it is, and the value of that property is greater than or equal to the computed trigger time for the alarm, then the client SHOULD NOT trigger the alarm. Similarly, if an alarm has been triggered and an "alert" presented to a calendar user, clients can monitor the iCalendar data to determine whether an "ACKNOWLEDGED" property is added or changed in the alarm component. If the value of any "ACKNOWLEDGED" property in the alarm changes and is greater than or equal to the trigger time of the alarm, then clients SHOULD dismiss or cancel any "alert" presented to the calendar user. This property is defined by the following notation:

The following is an example of this property:

Users often want to "snooze" an alarm, and this specification defines a standard approach to accomplish that. To "snooze" an alarm that has been triggered, clients MUST do the following: Set the "ACKNOWLEDGED" property (see ) on the triggered alarm. Create a new "VALARM" component (the "snooze" alarm) within the parent component of the triggered alarm (i.e., as a "sibling" component of the triggered alarm). The new "snooze" alarm MUST be set to trigger at the user's chosen "snooze" interval after the original alarm triggered. Clients SHOULD use an absolute "TRIGGER" property with a "DATE-TIME" value specified in UTC. The new "snooze" alarm MUST have a "RELATED-TO" property (see ) with a value set to the "UID" property value of the original "VALARM" component that was triggered. If the triggered "VALARM" component does not already have a "UID" property, the client MUST add one. The "RELATED-TO" property added to the new "snooze" alarm MUST include a "RELTYPE" property parameter with a value set to "SNOOZE" (see ). When the "snooze" alarm is triggered, the client MUST do the following: Update the "ACKNOWLEDGED" property on the original related alarm. If the "snooze" alarm is itself "snoozed", the client MUST remove the "snooze" alarm component, and return to step 2. Otherwise, if the "snooze" alarm is dismissed, the client MUST do one of the following: Set the "ACKNOWLEDGED" property on the "snooze" alarm. Remove the "snooze" alarm component. Note that regardless of the final disposition of the "snooze" alarm when triggered, the original "VALARM" component is left unchanged other than updating its "ACKNOWLEDGED" property.

This specification adds the "SNOOZE" relationship type for use with the "RELTYPE" property defined in Section 3.2.15 of . This is used when relating a "snoozed" "VALARM" component to the original alarm that the "snooze" was generated for.

The following example shows the snoozing, re-snoozing, and dismissal of an alarm. Note that the encompassing VCALENDAR component has been omitted for brevity and that the line-breaks surrounding the VALARM components are for clarity only and would not be present in the actual iCalendar data. Assume that we have the following event with an alarm set to trigger 15 minutes before the meeting:

When the alarm is triggered, the user decides to snooze it for 5 minutes. The client acknowledges the original alarm and creates a new "snooze" alarm as a sibling of, and relates it to, the original alarm (note that both VALARMs reside within the same "parent" VEVENT):

When the "snooze" alarm is triggered, the user decides to snooze it again for an additional 5 minutes. The client once again acknowledges the original alarm, removes the triggered "snooze" alarm, and creates another new "snooze" alarm as a sibling of, and relates it to, the original alarm (note the different UID for the new snooze alarm):

When the second "snooze" alarm is triggered, the user decides to dismiss it. The client acknowledges both the original alarm and the second "snooze" alarm:

VALARMs are currently triggered when a specific date-time is reached. It is also desirable to be able to trigger alarms based on location, e.g. when arriving at or departing from a particular location. This specification adds the following elements to "VALARM" components to indicate when an alarm can be triggered based on location. "PROXIMITY" property - indicates that a location based trigger is to be used and which action is used for the trigger "VLOCATION" component(s) - used to indicate the actual location(s) to trigger off of, specified with a URL property containing a geo: URI which allows for two or three coordinate values with an optional uncertainty

Typically, when a "PROXIMITY" property is used there is no need to specify a time-based trigger using the "TRIGGER" property. However, since "TRIGGER" is defined as a required property for a "VALARM" component, for backwards compatibility it has to be present, but ignored. To indicate a "TRIGGER" that is to be ignored, clients SHOULD use a value a long time in the past. A value of "19760401T005545Z" has been commonly used for this purpose.

PROXIMITY This property indicates that a location based trigger is applied to an alarm. TEXT IANA and non-standard property parameters can be specified on this property. This property can be specified within "VALARM" calendar components. This property is used to indicate that an alarm has a location-based trigger. Its value identifies the action that will trigger the alarm. When the property value is set to "ARRIVE", the alarm is triggered when the calendar user agent arrives in the vicinity of one or more locations. When set to "DEPART", the alarm is triggered when the calendar user agent departs from the vicinity of one or more locations. Each location which MUST be specified with a "VLOCATION" component. Note that the meaning of "vicinity" in this context is implementation defined. When the property value is set to "CONNECT", the alarm is triggered when the calendar user agent connects to a automobile to which is has been paired via Bluetooth(R). When set to "DISCONNECT", the alarm is triggered when the calendar user agent disconnects from a automobile to which it has been paired via Bluetooth(R). Note that neither current implementations of proximty alarms nor this document have a mechanism to target a particular automobile. Such a mechanism may be specified in a future extension. This property is defined by the following notation:

The following example shows a VALARM component with a proximity trigger set to trigger when the device running the calendar user agent leaves the vicinity defined by the URL property in the VLOCATION component. Note use of the "u=" parameter with the "geo" URI to define the uncertainty of the location determination.

In addition to the security properties of iCalendar (see Section 7 of ), VALARMs, if not monitored properly, can be used to disturb users and/or leak personal information. For instance, an undesirable audio alert could cause embarassment. An unwanted display alert could be considered an annoyance. Or an email alert could be used to leak a user's location to a third party or to send unsolicited email to multiple users. Therefore, CalDAV clients and servers that accept iCalendar data from a third party (e.g. via iTIP, a subscription feed, or a shared calendar) SHOULD remove all VALARMs from the data prior to storing in their calendar system. Security considerations related to unique identifiers for VALARMs are discussed in .

Proximity VALARMs, if not used carefully, can leak a user's past, present, or future location. For instance, storing an iCalendar resource containing proxmity VALARMs to a shared calendar on CalDAV server can expose to anyone that has access to that calendar the user's intent to leave from or arrive at a particular location at some future time. Furthermore, if a CalDAV client updates the shared iCalendar resource with an ACKNOWLEDGED property when the alarm is triggered, will leak the exact date and time that the user left from or arrived at the location. Therefore, CalDAV clients that implement proximity alarms SHOULD give users the option of storing and/or acknowledging the alarms on the local device only and not storing the alarm and/or acknowledgment on a remote server. Privacy considerations related to unique identifiers for VALARMs are discussed in .

This document defines the following new iCalendar properties to be added to the registry defined in Section 8.2.3 of and located here: Property Status Reference ACKNOWLEDGED Current RFCXXXX, PROXIMITY Current RFCXXXX,

This document defines the following new iCalendar relationship type to be added to the registry defined in Section 8.3.8 of and located here: Relationship Type Status Reference SNOOZE Current RFCXXXX,

This document creates a new iCalendar registry for values of the "PROXIMITY" property located here: Additional values MAY be used, provided the process described in Section 8.2.1 of is used to register them, using the template in Section 8.2.6 of . The following table has been used to initialize the Proximity Value Registry. Value Status Reference ARRIVE Current RFCXXXX, DEPART Current RFCXXXX, CONNECT Current RFCXXXX, DISCONNECT Current RFCXXXX,

This specification came about via discussions at the Calendaring and Scheduling Consortium. Also, thanks to the following for providing feedback: Bernard Desruisseaux, Mike Douglass, Jacob Farkas, Jeffrey Harris, Ciny Joy, Barry Leiba, and Daniel Migault.

&rfc2119; &rfc5545; &rfc5870; &rfc7986; &rfc8174; &idEventPub; &rfc4791; &rfc5546; Bluetooth Special Interest Group

Changes in ietf-06: Corrected timestamps in snooze example. Editorial changes from Benjamim Kaduk. Changes in ietf-05: Updated to use VLOCATION components rather than (deprecated) STRUCTURED-LOCATION properties for proximity alarms. Reorganized and clarified the process of snoozing an alarm and added an example. Noted that there is currently no mechanism for specifying a particular automobile for CONNECT/DISCONNECT proximity alarms. Replaced the term "spam" with new wording in Security Considerations. Addressed IESG comments from Benjamim Kaduk. Addressed IESG comments from Robert Wilton. Addressed IESG comments Alissa Cooper. Changes in ietf-04: Addressed security review comments from Valery Smyslov. Addressed Genart review comments from Roni Even. Added text addressing management of Proximity Value Registry. Changes in ietf-03: Fixed ABNF to be properly extended. Addressed AD review comments from Barry Leiba. Changes in ietf-02: Addressed some WGLC comments from Daniel Migault. Changes in ietf-01: Reintroduced the RELATED-TO property for VALARMs and the SNOOZE value for the RELTYPE property parameter. Add Privacy Considerations section. Changes in ietf-00: Submitted as CALEXT draft. Changes in daboo-05: Added Murchison as editor. Updated keywords boilerplate. Added reference to UID security/privacy recommendations. Removed default alarms. Removed ALARM-AGENT property. Added text about using TRIGGER value in the past in addition to ACTION:NONE to have a default alarm be ignored. Removed text about related alarms. Removed URL alarm action. Added reference to draft-ietf-calext-eventpub-extensions for STRUCTURED-LOCATION. Added CONNECT and DISCONNECT PROXIMITY property values. Added Security Considerations. Editorial fixes. Changes in daboo-04: Changed "ID" to "AGENT-ID". Add more text on using "ACKNOWLEDGED" property. Add "RELATED-TO" as a valid property for VALARMs. Add "SNOOZE" relationship type for use with VALARMs. State that "TRIGGER" is typically ignored in proximity alarms. Added "PROXIMITY" value registry. Added a lot more detail on default alarms including new action and property. Changes in daboo-03: none - resubmission of -02 Changes in daboo-02: Updated to 5545 reference. Clarified use of absolute trigger in UTC in snooze alarms Snooze alarms should be removed when completed Removed status and replaced last-triggered by acknowledged property Added location-based trigger IANA registry tables added Changes in daboo-01: Removed DESCRIPTION as an allowed property in the URI alarm. Added statement about what to do when ALARM-AGENT is not present. Allow multiple ALARM-AGENT properties to be present. Removed SNOOZE-UNTIL - snoozing now accomplished by creating a new VALARM. Remove VALARM by reference section. Added more detail to CalDAV default alarms.