Yadis: a service discovery protocol for URL-based identities

Yadis is a service discovery protocol designed for URL-based digital identities. Given an identifier in the form of a URL, Yadis lets a website find out which identity and authentication services that identifier supports. It became one of the building blocks of OpenID, the decentralized single sign-on system.

The problem Yadis solves

In decentralized identity systems, users identify themselves with a URL they control, such as a personal homepage or a profile address. A website that wants to accept that identity, called a relying party, needs to know how to talk to the services behind the URL: which protocols are supported, which versions, and which server endpoints to contact. Yadis provides a simple, standard way to answer those questions.

How it works

The Yadis discovery process has a few steps:

• The relying party requests the identity URL over HTTP, indicating that it accepts an XRDS document.
• The server either returns the XRDS document directly, points to it with a special HTTP header, or includes a reference in an HTML meta element.
• The relying party retrieves the XRDS document, an XML file that lists the services associated with the identifier.
• Each service entry names a type, such as a particular version of OpenID, and the URI of the endpoint that provides it, optionally with a priority.

The relying party then picks the service it supports and continues with that protocol.

XRDS documents

The XRDS format comes from the XRI work at OASIS. In the context of Yadis, it is used simply as a list of services. Because the format is extensible, the same document can describe several services at once, for example OpenID authentication, attribute exchange or other identity-related protocols.

Yadis and OpenID

Yadis was developed by members of the communities behind OpenID, LID and i-names, with the goal of letting different URL-based identity systems interoperate. Its discovery mechanism was later incorporated into OpenID Authentication, which uses XRDS-based discovery to locate a user's OpenID provider. Proxy-based OpenID providers and research projects linking electronic identity cards to OpenID also relied on this discovery step.

Legacy

Although newer identity standards such as OpenID Connect use different discovery mechanisms, Yadis played an important role in the early decentralized identity movement. It demonstrated how a plain URL could serve as an entry point to a set of identity services, an idea that continues to influence how federated login systems are designed.