Is it possible to publish/deploy a web package, using a non-admin account, from the command line only?

Question

The title needs some expansion. In summary, I am finding it impossible to:

• Deploy a web site to an IIS 8 host
• Using a Web Deploy Package
• Using the out-of-the-box publish functionality in VS 2013
• Using a non-admin IIS Manager User, which is delegated permission to deploy to the given site

It all seems to come down to one small detail that messes it all up, but I should describe my process up to the point where it all falls apart.

I create a publish profile Publish in VS 2013, configured to publish to a web package. I then fire the following command at a developer command prompt:

msbuild Solution.sln /t:Build /p:DeployOnBuild=true;PublishProfile=Publish;IsDesktopBuild=false

This goes through a build process and I now see the expected package and deployment files in the _PublishedWebsites\Web_Package folder. My next step is run this from the Web_Package folder:

Web.deploy.cmd /Y /M:https://example.blah:8172/MsDeploy.axd /U:user /P:p@44w0rd /A:Basic

This is where the problem comes in. This results in the following expanded command (formatted for ease of reading):

msdeploy.exe
    -source:package='.\Web.zip'
    -dest:auto,computerName="https://example.blah:8172/MsDeploy.axd",userName="user",password="p@44w0rd",authtype="Basic",includeAcls="False"
    -verb:sync 
    -disableLink:AppPoolExtension 
    -disableLink:ContentExtension 
    -disableLink:CertificateExtension 
    -setParamFile:".\Web.SetParameters.xml"

whose execution results in:

Error Code: ERROR_USER_UNAUTHORIZED
More Information: Connected to the remote computer ("example.blah") using the Web Management Service, but could not authorize. Make sure that you are using the correct user name and password, that the site you are connecting to exists, and that the credentials represent a user who has permissions to access the site.  Learn more at: http://go.microsoft.com/fwlink/?LinkId=221672#ERROR_USER_UNAUTHORIZED.

I can fix this problem by manually re-running just the expanded command and tagging on the site parameter to the MsDeploy.axd URL, like so:

msdeploy.exe
    -source:package='.\Web.zip'
    -dest:auto,computerName="https://example.blah:8172/MsDeploy.axd?site=example.blah",userName="user",password="p@44w0rd",authtype="Basic",includeAcls="False"
    -verb:sync 
    -disableLink:AppPoolExtension 
    -disableLink:ContentExtension 
    -disableLink:CertificateExtension 
    -setParamFile:".\Web.SetParameters.xml"

However, I cannot see any way to have this set through Web.deploy.cmd which was auto-generated by MSBuild. If I try this:

Web.deploy.cmd /Y /M:https://example.blah:8172/MsDeploy.axd?site=example.blah /U:user /P:p@44w0rd /A:Basic

It results in this (again, formatted for ease of reading):

msdeploy.exe
    -source:package='D:\DEV\Solution\Web\bin\_PublishedWebsites\Web_Package\Web.zip'
    -dest:auto,computerName="https://example.blah:8172/MsDeploy.axd?site",userName="user",password="p@44w0rd",authtype="Basic",includeAcls="False"
    -verb:sync 
    -disableLink:AppPoolExtension 
    -disableLink:ContentExtension 
    -disableLink:CertificateExtension 
    -setParamFile:"D:\DEV\Solution\Web\bin\_PublishedWebsites\Web_Package\Web.SetParameters.xml"  example.blah
Error: Unrecognized argument 'example.blah'. All arguments must begin with "-".
Error count: 1.

I can perform this process fine using an admin account. But it seems that the non-admin requires this site= querystring value and the auto-generated Web.deploy.cmd just isn't having any of that.

Am I missing something obvious here? Is there a permission I'm missing on the IIS Management side? I've made sure I have the Management Service Delegation rule set up, as directed in this blog post.

Answer 1

I can't see a way around this using the process I've laid out. My solution here is to simply take the expanded MSDeploy.exe command line and use it directly instead of the generated *.deploy.cmd file.

Of course, if anyone comes along with an actual solution to my original problem, I'll happily mark that one as the answer. Until then, this is my solution.