IAPL - User Cloner
Clone Salesforce users between authenticated orgs, or grant access to an existing user.
How it works
The panel opens at once with the current sf target-org and the configured source and target orgs; the full org list loads in the background. Actions that write to an org wait for that list, to know whether the target is production. The panel has three modes. They use Salesforce CLI and never copy passwords, tokens, or sessions. Queries use the CLI session over REST: the session is read once per org, kept in memory, and never shown.
Clone user
- Pick the source org and search for the user (name or username). You can limit results to active users.
- Pick the target org. The target username is proposed with a suffix (by default the lowercase target alias).
- Review the map: profile, role, Permission Sets, Permission Set Licenses, groups, and compatible custom fields.
- Run dry-run, then clone if the preview looks correct.
The user is created inactive unless you choose otherwise. Source org IDs are never reused: profile, role, and assignments resolve by name on the target. Missing names on the target are skipped and listed in the report.
After create, the panel shows a link to the user, a per-category summary, and retry for failed assignments only. Local history keeps the last 50 operations (no credentials). Export as JSON or CSV.
Assign access
For a user that already exists on the target org:
- Load the Permission Set and group catalog.
- Optional: copy the selection from another user (same org or another authenticated org).
- Tick what is missing. Dry-run classifies: create / already assigned / not on target.
- Assign missing. Access is never revoked.
Explain access
Answers why a user has, or lacks, a given access, and where it comes from. The mode only reads; it changes nothing.
- Pick the org and the user.
- Choose a question:
- All access sources: profile, permission sets (with expiration date), permission set groups and their components, public groups, queues, and role groups (own role and higher roles).
- Object or field: type in the object box to get suggestions by API name or label. Once you pick an object, the field box suggests its fields (leave it empty to ask about the object only). The panel shows CRUD, View All and Modify All per source, then FLS. Permissions a group component grants but the group's muting permission set removes are flagged. View All Data and Modify All Data are also checked.
- System permission: for example
ApiEnabled or ViewSetup. The list comes from the org.
- Record: effective level (
UserRecordAccess) and the reason: OWD, owner, owning queue, role hierarchy, and share rows (manual, sharing rule, team, Apex sharing), including those reached through a group or role. For objects controlled by their parent, the master record is explained.
- When the access is missing, the panel lists the permission sets in the org that would grant it. Prepare assignment opens the Assign tab with that user and those sets preselected. The dry-run still runs before anything is assigned.
Not covered: territories and portal or implicit sharing. When access has no visible cause, the panel says so.
What is copied and what is not
- Identity and contact: required.
- Profile and license: profile is matched by name on the target.
- Locale and preferences: when the field is createable on the target.
- Custom
User fields: only if they exist on both orgs, are createable, share the same type, and are not formula, autonumber, or lookup.
- Role, Permission Sets, Permission Set Licenses, and groups: by
DeveloperName or API name.
- Custom lookups: omitted (IDs are not portable across orgs).
- Welcome email and password: not sent. Use Reset Password in Setup.
Security
Production as a target is blocked by default. To allow it, enable iaplUserCloner.allowProductionTarget in editor settings; each operation still asks for extra confirmation.
Salesforce usernames are globally unique. Preflight detects duplicates on the target; another org outside this CLI can still reject create.
Requirements
Salesforce CLI (sf), authenticated orgs, permission to query users on the source and to create the user or assignments on the target, and an available license on the target.
