I want to implement two use cases and I was unable to do so:

VISIBILITY OF ALBUMS
1. I want to have two albums: One for friends and one for family
2. My friends should see the friends but not my Family album
3. My family should see the family album but not the friends album

What I did:
1. I assigned username/password to both albums
2. I registered all family / friends and distributed username/password

Then I got stuck: The only way to implement the use case was to forget the site registration and just distribute the username/pass for each user. Any better idea?

The alternative was that I give each group ADMIN access to the respective album which then allows to see the album but has the undesirable side effect of being able to edit it, too.

Any idea, how I could implement something resembling normal role-based access? (assign friends to FRIENDS group and give FRIENDS group read (but not write) access to friends album?

The easiest way I can think of to implement this is to create two user groups: one for family and one for friends. Make the family group have the family album as a managed album and the opposite for friends. Then, unpublish both albums. It should work out that only the members of the family group can see the family album and the opposite for friends.

This should work because unpublished albums are hidden from users who don't have access. As long as the user is a member of the respective group, he can see the album because of the group's access. I believe this method will also not yield access to editing the album, though.

The only drawback of this method is that you'll have to manually assign each user to the respective group. But I think that would be necessary no matter what method.

please also see http://www.zenphoto.org/2009/03/troubleshooting-zenphoto/#46

Thanks a lot for the fast reply. Somehow I was unable to 'implement' your proposal: Using this approach, my friends had admin rights and would have been able to delete albums.

I guess my fundamental misunderstanding is that I want to manage the access rights of "users" while I think ZenPhoto only allows managing access rights for admins.

I will now remove my users and use plain username/password pairs per album. I guess I am too paranoid to fit into the "normal web-album users" category...

Never mind & thanks a lot for the instant support!

Did you give the groups rights? The groups don't need any rights just to view albums; simply having the respective album as a managed album should be sufficient.

Also see http://www.zenphoto.org/2008/07/an-overview-of-zenphoto-users/ for more info on user/group rights.