Microsoft Wednesday released a beta of its most important tool to date for helping developers build applications that can plug into the company's Identity Metasystem and provide what amounts to a re-usable identity service for securing network resources.

Code-named Zermatt, the tools are a new extension to the .Net Framework 3.5 that helps developers more easily build applications that incorporate a claims-based identity model for authentication/authorization. Claims are a set of statements that identify a user and provide specific information such as title or purchasing authority.

The model, developed by Microsoft but garnering industry support, uses standard protocols such as WS-Federation, WS-Trust and the Security Assertion Markup Language (SAML).

The final release of Zermatt is expected by year-end.

The technology not only eases development of claims-aware applications, but should also benefit IT by making it easier to deploy, manage and secure applications, according to Microsoft.

It is the first time Microsoft has so directly written its sizeable development army into its Identity Metasystem, plan, which was outlined first in 2005 and defines a distributed identity architecture for multi-vendor platforms.

Claims, which are part of the architecture, are used by systems to make such decisions as who gets access, who can retrieve content or who can complete transactions.

Data contained in the claims can come from Active Directory, LDAPv3-based directories, application-specific databases and new user-centric identity models such as LiveID, OpenID and InfoCard systems including Microsoft's CardSpace and Novell's Digital Me.

Zermatt is specific to developing Windows-based applications, but Microsoft officials say clones of the technology could be developed to write applications that run on any platform.

And given the standards nature of the Identity Metasystem, those applications could plug into the same identity services as Zermatt-developed applications.

Key to the claims-based model is something called a Security Token Service (STS), lightweight gateways for servers and clients that negotiate the exchange of security tokens, such as Kerberos or SAML, and that can translate tokens into different formats depending on an application's needs.