It looks like there are some extra arguments at the end of the -MapRolesToUsers block. I'm not sure if those are throwing off wsadmin. Here's the IBM documentation on MapRolesToUsers (source):
AdminApp.install('myapp.ear', '[-MapRolesToUsers [["All Role" No Yes "" ""]["Every Role" Yes No "" ""] [DenyAllRole No No user1 group1]]]')
where {{"All Role" No Yes "" ""} corresponds to the following:
"All Role" Represents the role name
No Indicates to allow access to everyone (yes/no)
Yes Indicates to allow access to all authenticated users (yes/no)
"" Indicates the mapped users
"" Indicates the mapped groups
Try changing the MapRolesToUsers block to this:
-MapRolesToUsers [[ security AppDeploymentOption.No AppDeploymentOption.Yes "" "" ]]