title: Can Web Deploy's setAcl provider be used on a sub-directory?
body: <p>I'm trying to make a subdirectory in an MS Deploy package writable to the application pool user.  Thanks to a <a href="http://leethams.wordpress.com/2010/06/12/modifying-directory-permissions-with-web-deployment/" rel="noreferrer">helpful post about the setAcl provider</a> by Kevin Leetham I was able to get most of what I need into my project file:</p>
  
  <pre><code>&lt;MsDeploySourceManifest Include="setAcl"
                          Condition="$(IncludeSetAclProviderOnDestination)"&gt;
    &lt;Path&gt;$(_MSDeployDirPath_FullPath)\doc\public&lt;/Path&gt;
    &lt;setAclAccess&gt;Read,Write,Modify&lt;/setAclAccess&gt;
    &lt;setAclResourceType&gt;Directory&lt;/setAclResourceType&gt;
    &lt;AdditionalProviderSettings&gt;setAclResourceType;setAclAccess&lt;/AdditionalProviderSettings&gt;
  &lt;/MsDeploySourceManifest&gt;
  </code></pre>
  
  <p>Note that I've added "\doc\public" to the root deployment directory.  In the resulting manifest that VS2010 builds, I see the following setAcl element:</p>
  
  <pre><code>&lt;sitemanifest&gt;
    &lt;contentPath path="C:\Source\...\obj\Debug\Package\PackageTmp" /&gt;
    &lt;setAcl path="C:\Source\...\obj\Debug\Package\PackageTmp"
            setAclResourceType="Directory" /&gt;
    &lt;setAcl path="C:\Source\...\obj\Debug\Package\PackageTmp"
            setAclUser="anonymousAuthenticationUser"
            setAclResourceType="Directory" /&gt;
    &lt;setAcl path="C:\Source\...\obj\Debug\Package\PackageTmp\doc\public"
            setAclResourceType="Directory"
            setAclAccess="Read,Write,Modify" /&gt;
  &lt;/sitemanifest&gt;
  </code></pre>
  
  <p>That last line looks good: it's appended the subdirectory I want to be writable, and the access modifiers all seem to have transferred over well enough.</p>
  
  <p>However, when I deploy this package I receive an error:</p>
  
  <blockquote>
    <p>Error: A value for the 'setAclUser' setting must be specified when the
    'setAcl' provider is used with a physical path.</p>
  </blockquote>
  
  <p>This is a confusing error because I'm not trying to set an ACL on a physical path, exactly, but a subdirectory of a web application.  Looking at the output of MS Deploy, it's easy to see the problem:</p>
  
  <pre><code>Info: Adding setAcl (REST Services\1.0.334).
  Info: Adding setAcl (REST Services\1.0.334).
  Info: Adding setAcl (C:\...\obj\Release\Package\PackageTmp\doc\public).
  </code></pre>
  
  <p>MS Deploy is apparently substituting the web application name for my absolute path "C:...\obj\Release\Package\PackageTmp", but when I append "\doc\public" to that absolute path it no longer recognizes it as a web application directory.  This exact problem is described by another victim <a href="http://forums.asp.net/t/1697424.aspx/1?MSDeploy%20SetAcl%20for%20sub%20directory" rel="noreferrer">over on the ASP.NET forums</a> without any resolution.</p>
  
  <p>Does anyone know how to set an ACL on a particular subdirectory of a web application via Web Deploy without manually identifying the physical path and application pool user on the target host?</p>