Do you want the application “identityservicesd.app” to accept incoming network connections?

Thanks! That is helpful, but doesn't go all the way to answering my question. Specifically:

1. What does this benign process do?
2. Why does this process need to accept incoming connections from arbitrary outside machines?
3. More philosophical/rhetorical: If this benign process always needs to be open to the outside world, why on earth should Apple make me decide whether or not to open it, on a basis of complete ignorance, instead of Apple doing it for me? Why ask me questions I am in no position to answer? This kind of thing is a contributing cause to why computer security is such a disaster.

For what it's worth, I am only running Apple's firewall.

What's odd about this is that if I'm dealing with third-party credentials, shouldn't the identity services daemon only need to connect out to other systems? Why would third party credentials servers be initiating connections to my Mac from outside. This still seems kind of odd.

Is identityservicesd the same as Unix identd?

Also, TCP and UDP ports used by Apple software products - Apple Support does not list port 301, which is the port that identityservicesd has opened on my Mac, but does list "identification protocol" as listening on port 113. The Activity Monitor lists "Ports," but the help does not specify if those are source or destination (listening) ports. Google Drive Helper (Renderer) is listed at port 113, but I don't know if that is a listening port. Presumably so?

Anyway, while I do see identityservicesd in the activity monitor, neither lsof nor netstat show it as opening a listening port. So I am still pretty confused.

Thanks. The passfab article explains what identityservicesd is, but again, doesn't say why it should be accepting connections from outside as opposed to initiating connections to outside.

The second (Apple Stackexchange) article is a little more helpful, the identity services allow a user to authenticate, so I guess that would call for accepting local connections from applications that want to use the identity service for authentication to some third party application. But again, why accept incoming connections from outside? Perhaps there's some handshaking where a local application can redirect an outside server to the identity server daemon to get credentials?

The API documentation referenced from the Stackexchange article (Introduction to Identity Services Programming Guide) doesn't explain why there would be external access, either.