Web.config not being parametrized on deploy

问题

I have an ASP MVC app that I'm deploying to intranet servers via TeamCity, and I need some appSettings to be parametrized on deploy, so that client secrets stay hidden from developers etc.

I have the Parameters.xml file in the root of my project, the SetParameters.xml that is built with the package correctly contains all these parameters and their default values. However changing these values (even passing them to MSDeploy with -setParam) doesn't result in any changes in deployed web.config.

When I change the values in the SetParameters.xml file (which is passed to MSDeploy correctly afaik), the settings in the deployed web.config don't change and while there are "Verbose: Parameter entry 'IIS Web Application Name/1' is applicable" entries in log (IIS Web Application Name being another, standard, parameter), there's no mention of my appSettings parameters.

Also When I import the application with IIS Manager, it asks me for the values for these parameters, but I don't see them mentioned in verbose logs either, and the web.config doesn't get updated at all unless there really were some changes, and in that case the parameters aren't replaced.

My parameters.xml look like this:

<?xml version="1.0" encoding="utf-8" ?>
<parameters>
  <parameter name="PiwikToken" defaultValue="__PIWIKTOKEN__">
    <parameterEntry type="XMLFile" scope="\\web\.config$" match="/configuration/appSettings/add[@key='PiwikToken']/@value"/>
  </parameter>
  <parameter name="LoginClientSecret" defaultValue="__LOGINSECRET__">
    <parameterEntry type="XMLFile" scope="\\web\.config$" match="/configuration/appSettings/add[@key='LoginClientSecret']/@value"/>
  </parameter>
  <parameter name="SecondClientSecret" defaultValue="__SECONDSECRET__">
    <parameterEntry type="XMLFile" scope="\\web\.config$" match="/configuration/appSettings/add[@key='SecondClientSecret']/@value"/>
  </parameter>
</parameters>

I've tried other scope variations ("web.config$", "web.config", "\\web.config$", "\\web\.config$", "Portal\web.config$"...) and it didn't change a thing. The XPath expressions tested against my web.config work OK.

web.config:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <appSettings>
    <add key="webpages:Version" value="3.0.0.0" />
    <add key="webpages:Enabled" value="false" />
    <add key="ClientValidationEnabled" value="true" />
    <add key="UnobtrusiveJavaScriptEnabled" value="true" />
    <add key="LoginClientId" value="portalLocal" />
    <add key="RedirectAfterAuthUrl" value="https://localhost:44321/" />
    <add key="PiwikSiteId" value="12" />
    <add key="PiwikToken" value="__PIWIKTOKEN__" />
    <add key="LoginClientSecret" value="__LOGINSECRET__" />
    <add key="SecondClientSecret" value="__SECONDSECRET__" />
  </appSettings>
  <connectionStrings>
    <add name="appDB" connectionString="..." />
  </connectionStrings>
...

Other things I've checked:

Parametrization in MSDeploy is switched on

The file "parameters.xml", which is generated inside the .zip package, contains

<parameters>
  <parameter name="IIS Web Application Name" defaultValue="Portal" tags="IisApp">
    <parameterEntry kind="ProviderPath" scope="IisApp" match="^D:\\BuildAgent\\work\\fec2f9c37ed1ec8e\\Portal\\obj\\DEV\\Package\\PackageTmp$" />
    <parameterEntry kind="ProviderPath" scope="setAcl" match="^D:\\BuildAgent\\work\\fec2f9c37ed1ec8e\\Portal\\obj\\DEV\\Package\\PackageTmp$" />
  </parameter>
  <parameter name="Add write permission to App_Data Folder" description="Add write permission to App_Data folder" defaultValue="{IIS Web Application Name}/App_Data" tags="Hidden">
    <parameterEntry kind="ProviderPath" scope="setAcl" match="^D:\\BuildAgent\\work\\fec2f9c37ed1ec8e\\Portal\\obj\\DEV\\Package\\PackageTmp\\App_Data$" />
  </parameter>
  <parameter name="PiwikToken" defaultValue="__PIWIKTOKEN__" />
  <parameter name="LoginClientSecret" defaultValue="__LOGINSECRET__" />
  <parameter name="SecondClientSecret" defaultValue="__SECONDSECRET__" />
</parameters>

According to various sources across the net, the common cause for this would be that the scope is wrong or that the match regexp is wrong, but I've tried all kinds of variants without success.

If anyone has any ideas about what to try, or what could be the cause, I'll be glad to explore further or try it out, but right now I've spent a few days on this and cannot think of what else to try. Thanks!

EDIT: Now I've created a fresh WebAPI project with MVC, added just parameters.xml, added those parameters to web.config, and the web.config still doesn't get parametrized on deploy. So is it some IIS setting somewhere?

EDIT2: After experimenting I found out that the generated parameters.xml inside the zip package really should containt "match" and "scope" attributes and they don't - since when I rewrite the xml so that it contains parameterEntry with proper match and scope, and repackage it into the zip, it starts working.

EDIT3: And the problem seems to be having attribute named "type", when it should've been named "kind". Now I only wonder, where did I first get that example I used...