Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I can't wrap my head around how Yadis / XRDS would be used by a typical end user, or how it works so transparently? Considering that this technology isn't adopted by mainstream IDPs that makes me think this is an abandoned technology (last wiki edit was 2008).

How does Yadis / XRDS work, and is it applicable or relevant today?

share|improve this question
1  
I think your conclusion that it is not adopted is wrong, the list is outdated. For example both Google and Yahoo are missing. – Hendrik Brummermann♦ Oct 29 '11 at 17:17
@HendrikBrummermann Is an OpenID provider and a Yadis / XRDS implementation one of the same? – makerofthings7 Oct 29 '11 at 18:50
An openid provider is more, yadis/xrds is used as part of an openid-login. The consumer web site uses it to learn about the capabilities and full urls of the identity provider. But the openid provider has to do additional things, e. g. provide a login form to the end user, and confirm the login to the consumer. – Hendrik Brummermann♦ Oct 29 '11 at 19:15

1 Answer

up vote 3 down vote

If you login to a website such as security.stackexchange.com via OpenID, the website will use yadis/xrds to discover the identity provider based on the information entered by the user.

The website may need to redirect the user to the discovered login page of the identity provider, unless he is already logged into his identity provider and has told it to automatically accept login requests from the website. The yadis/xrds-discovery itself is not visible to the user, but of course he will end up at the right website (if everyone plays nice and does not attempt to phish for accounts)

In the end the website will use the discovered information to verify the identity and may retrieve additional information about the user.

You can find more information in the OpenID specification.

share|improve this answer
I'll read the spec, but I just don't get when and how the HTTP header or Meta tag is processed/used – makerofthings7 Oct 29 '11 at 17:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.