Problem deploying with Web Deploy and ACLs

Question

I'm deploying a web application to my host using Web Deploy. When run from Visual Studio using the Publish command it works fine. When I try to deploy using web deploy from MSBuild the website becomes inaccessible and even the web control panel of my web host can no longer access the website. I've tracked it down to what I think is permissions on the web site folders.

Publishing from Visual Studio updates the ACLs and the website works properly and the web host's control panel works (even if it was broken via the deploy from MSBuild prior).

The following is the output when run from Visual Studio:

------ Publish started: Project: mywebapp, Configuration: Release Any CPU ------
Transformed Web.config using Web.Release.config into obj\Release\TransformWebConfig\transformed\Web.config.
Auto ConnectionString Transformed Views\Web.config into obj\Release\CSAutoParameterize\transformed\Views\Web.config.
Auto ConnectionString Transformed obj\Release\TransformWebConfig\transformed\Web.config into obj\Release\CSAutoParameterize\transformed\Web.config.
Copying all files to temporary location below for package/publish:
obj\Release\Package\PackageTmp.
Start Web Deploy Publish the Application/package to https://myhost.net:8172/MsDeploy.axd?site=mywebapp.com ...
Updating setAcl (mywebapp.com).
Updating setAcl (mywebapp.com).
Updating filePath (mywebapp.com\bin\mywebapp.Core.dll).
Updating filePath (mywebapp.com\bin\mywebapp.Core.pdb).
Updating filePath (mywebapp.com\bin\mywebapp.dll).
Updating filePath (mywebapp.com\bin\mywebapp.pdb).
Updating filePath (mywebapp.com\Views\Web.config).
Updating filePath (mywebapp.com\web.config).
Updating setAcl (mywebapp.com).
Updating setAcl (mywebapp.com).
Publish is successfully deployed.
========== Build: 2 succeeded or up-to-date, 0 failed, 0 skipped ==========
========== Publish: 1 succeeded, 0 failed, 0 skipped ==========

I found a file that I think Visual Studio is using during the deploy that contains ACL information. It's called myapp.SourceManifest.xml and was in the C:\Projects\mywebapp\obj\Release\Package folder.

<?xml version="1.0" encoding="utf-8"?>
<sitemanifest>
  <contentPath path="C:\Projects\mywebapp\obj\Release\Package\PackageTmp" />
  <setAcl path="C:\Projects\mywebapp\obj\Release\Package\PackageTmp" setAclResourceType="Directory" />
  <setAcl path="C:\Projects\mywebapp\obj\Release\Package\PackageTmp" setAclUser="anonymousAuthenticationUser" setAclResourceType="Directory" />
</sitemanifest>

My MSBuild file contains the following to perform the deployment:

<Exec Command='"$(ProgramFiles)\IIS\Microsoft Web Deploy v2\msdeploy.exe" -verb:sync -source:package="mywebapp\obj\test\package\mywebapp.zip" -dest:auto,computername="https://myhost.net:8172/MsDeploy.axd?site=mywebapp.com",username=XXXX,password=XXXX,authtype=basic -allowuntrusted:true -setparam:name="IIS Web Application Name",value="mywebapp.com"' />

When I run MSBuild to deploy I can see files being updated but no ACLs are updated.

My MSBuild deployment is coming from a different folder due to a different configuration (Test rather than Release) and the mywebapp.SourceManifest.xml file is different.

<?xml version="1.0" encoding="utf-8"?>
<sitemanifest>
  <IisApp path="C:\Projects\mywebapp\obj\Test\Package\PackageTmp" managedRuntimeVersion="v4.0" />
</sitemanifest>

The differing mywebapp.SourceManifest.xml files probably have something to do with it? What do I need to do to get the ACLs updated?

---

Update

I found that the difference in the mywebapp.SourceManifest.xml file was being caused by the presence of the following in the .csproj file for my Test configuration.

<IncludeSetAclProviderOnDestination>False</IncludeSetAclProviderOnDestination>

I've changed that to True and now the manifest files are the same between Test and Release configurations.

I also found that when using Publish from Visual Studio, that it works for Release but fails for Test. So I'm now trying to figure out what is different between the two configurations that causes a successful or broken deploy.

Answer 1

I managed to get it working. According to my web host there are some problems with Web Deploy that they're working through with Microsoft's Web Deploy & IIS teams and they had to apply some temp fixes on the server. Strange, as it all used to work a couple of months ago.

I ended up restoring the <IncludeSetAclProviderOnDestination>False</IncludeSetAclProviderOnDestination> setting in my project file to prevent Web Deploy from touching the ACLs. My web host said that it was removing the permissions of the app pool identity and preventing the web control panel from being able to access the website folders.

They also told me to add <_MSDeployVersionsToTry Condition="'$(_MSDeployVersionsToTry)'==''">7.1;8.0;9.0</_MSDeployVersionsToTry> to the project file. I added it, although I'm not sure if it made a difference.