IAPL - User Cloner

Clone Salesforce users between authenticated orgs, or grant access to an existing user.

How it works

The panel has two modes. Both use Salesforce CLI; they do not copy passwords, tokens, or sessions.

Clone user

1. Pick the source org and search for the user (name or username). You can limit results to active users.
2. Pick the target org. The target username is proposed with a suffix (by default the lowercase target alias).
3. Review the map: profile, role, Permission Sets, Permission Set Licenses, groups, and compatible custom fields.
4. Run dry-run, then clone if the preview looks correct.

The user is created inactive unless you choose otherwise. Source org IDs are never reused: profile, role, and assignments resolve by name on the target. Missing names on the target are skipped and listed in the report.

After create, the panel shows a link to the user, a per-category summary, and retry for failed assignments only. Local history keeps the last 50 operations (no credentials). Export as JSON or CSV.

Assign access

For a user that already exists on the target org:

1. Load the Permission Set and group catalog.
2. Optional: copy the selection from another user (same org or another authenticated org).
3. Tick what is missing. Dry-run classifies: create / already assigned / not on target.
4. Assign missing. Access is never revoked.

What is copied and what is not

• Identity and contact: required.
• Profile and license: profile is matched by name on the target.
• Locale and preferences: when the field is createable on the target.
• Custom User fields: only if they exist on both orgs, are createable, share the same type, and are not formula, autonumber, or lookup.
• Role, Permission Sets, Permission Set Licenses, and groups: by DeveloperName or API name.
• Custom lookups: omitted (IDs are not portable across orgs).
• Welcome email and password: not sent. Use Reset Password in Setup.

Security

Production as a target is blocked by default. To allow it, enable iaplUserCloner.allowProductionTarget in editor settings; each operation still asks for extra confirmation.

Salesforce usernames are globally unique. Preflight detects duplicates on the target; another org outside this CLI can still reject create.

Requirements

Salesforce CLI (sf), authenticated orgs, permission to query users on the source and to create the user or assignments on the target, and an available license on the target.