MSBuild Permissions - ACL - Entire IIS Folder

Question

I'm fairly new to MSBuild, having discovered it's sheer power whilst automating many of our processes. I'm currently setting up our TARGETS files for our web projects, and I'm looking to set a global permission ACL for when the application is built in DEBUG mode.

I understand, that these should be in the Debug.pubxml, (insert name of publishing profile, etc)

In VS, when an application is run using IIS Express, the entire application is writable, which is good for debugging. I'd like to offer the same behavior when deploying the application to IIS using WebDeploy in the DEBUG profile.

I've followed Sayed's Blog which outlines how to set a folder permission and eventually moved across to the following solution - which gives a good reusable pattern for setting permissions on any folder. Microsoft IIS Forum Post

However from my learnings from these two examples, I've been unable to successfully set 'Read,Write' aclAccess on the deployment directory. Which I believe should be $(_MSDeployDirPath_FullPath).

As a sub note are there any recommendations for structuring these MSBuild files? E.g. splitting components out so they are reusable, or naming patterns to make it easier for developers to understand what is happening?

Best of wishes, Laurence

Answer 1

The below post and Sayed's help via Twitter lead to a solution and a better understanding of both the solution.

The MSBuild rules in this case are placed inside the 'Debug.pubxml' file. This is the publishing profile that requires the entire IIS directory to be writable. To make this a 'default' behavior across the project place inside the {project-name}.wpp.targets file.

Further reading : MSDN Article on Publishing Profiles (.pubxml)

+1 as above, reading the MSBuild *.targets files is very useful.

<!-- Make entire IIS directory writable -->
<Target Name="SetupCustomAcls" AfterTargets="AddIisSettingAndFileContentsToSourceManifest">
<Message Text="SetupCustomAcls" Importance="high"/>
<ItemGroup>
  <MsDeploySourceManifest Include="setAcl">
    <Path>$(_MSDeployDirPath_FullPath)</Path>
    <setAclAccess>Modify</setAclAccess>
    <setAclResourceType>Directory</setAclResourceType>
    <AdditionalProviderSettings>setAclResourceType;setAclAccess</AdditionalProviderSettings>
  </MsDeploySourceManifest>
</ItemGroup>
 </Target>

 <Target Name="DeclareCustomParameters" AfterTargets="AddIisAndContentDeclareParametersItems">
<Message Text="DeclareCustomParameters" Importance="high"/>
<ItemGroup>
  <MsDeployDeclareParameters Include="CustomSetAclParam">
    <Kind>ProviderPath</Kind>
    <Scope>setAcl</Scope>
    <Match>^$(_EscapeRegEx_MSDeployDirPath)$</Match>
    <Description>Add write permission to the root folder.</Description>
    <DefaultValue>{$(_MsDeployParameterNameForContentPath)}</DefaultValue>
    <Value>$(_DestinationContentPath)</Value>
    <Tags>Hidden</Tags>
    <Priority>$(VsSetAclPriority)</Priority>
    <ExcludeFromSetParameter>True</ExcludeFromSetParameter>
  </MsDeployDeclareParameters>
</ItemGroup>
  </Target>

Answer 2

I had problems myself with MsDeploy task and I opted out for Msdeploy executable directly. Here is what worked for me.

 <Exec Command="msdeploy -verb:sync -source:setacl -dest:setacl=&quot;%(FoldersWithSpecialPermissions.Identity)&quot;,setAclUser=NetworkService,setAclAccess=Modify,computerName=$(ComputerName),UserName=$(UserName),password=$(Password),authtype=basic -allowUntrusted" WorkingDirectory="$(MSDeployPath)" />

About patterns, the best thing to do is to open up

C:\Program Files (x86)\MSBuild\Microsoft\VisualStudio\v11.0***.targets

and check how Microsoft has organized the build templates.

I hope that helps