sf org create user in non scratch org environment

[MichaelPStimpson]

Hello, I love the user definition file for scratch org users. Is there any reason we can't bulkify this command and add support for sandbox environments?

I see we're explicitly checking for it here on line 306.

I also see the following bit here:

After the new user has been created, Salesforce CLI automatically authenticates it to the scratch org so the new user can immediately start using the scratch org. The CLI uses the same authentication method that was used on the associated Dev Hub org. Due to Hyperforce limitations, the scratch org user creation fails if the Dev Hub authentication used the JWT flow and the scratch org is on Hyperforce. For this reason, if you plan to create scratch org users, authenticate to the Dev Hub org with either the "org login web" or "org login sfdx-url" command, and not "org login jwt".

I've also found past posts discussing this here
I'm curious why user definition file isn't something exposed to non scratch org user creation.

Is this an effort already in progress to deliver something like this?
(and if not) Are there any suggestions for implementing this feature?

[mshanemc]

there wasn't a lot of votes/activity for #2606 so we haven't prioritized it.

[mshanemc]

as far as bulkification...I think I'd rather you manage that via scripts. Bulkification can get you into weird partialSuccess states (user 1-4 created successfully, 5 failed, 6 failed but only because it depended on 5 to exist, etc).

by non-scratch do you also mean sandboxes, or would you really want to be able to create prod users via the CLI?

[MichaelPStimpson]

That makes sense! As for non-scratch orgs, I do mean sandboxes.

[MichaelPStimpson]

It would be nice if it also supported group membership as well

[VivekMChawla]

@MichaelPStimpson - Hello! I'm Vivek M. Chawla, Product Manager for the Salesforce CLI.

Could you elaborate on what you'd like to accomplish by creating sandbox users with the CLI?

Are there particular pain points you experience while creating sandbox users in other ways, for example, User record insertion/creation via API, Apex, or Flows?

Regarding bulkification, I agree with @mshanemc that's something best managed via scripts. That way, your automation logic is in the driver's seat when it comes to failures, retries, etc.

[MichaelPStimpson]

Hello @VivekMChawla, nice to meet you!

I understand the user definition files to be syntaxial sugar to data plans, but it's a great feature for clearly defining an applications various personas in one place in source control. (instead of having CSVs for multiple tables)

When creating or refreshing sandboxes we create test users preconfigured to match various user personas. (Profile, permission set, permission set group, permission set license, group, queue, etc.) At the moment we're using a sfdx data plan, but when changes are needed to the test users personas we have to duplicate that effort across test users (i.e. adding a new group to the persona could require updates to multiple rows in the data json file) and it can be error prone if done manually.

I see the code mentions a lack of support for Hyperforce, but I didn't look too deep. That would be nice as well, I'm operating in a "soon to be migrated to Hyperforce" org. I see the user definition tables are limited to just supporting permsets and profile at the moment, opening that up to include permission set group, permission set license, and group/queue membership would simplify and centralize our persona definitions in one easy to understand place.

I think it's easy enough to script out bulkification, so that makes sense! Being able to define all the configuration associated with a persona in one place regardless of environment strategy would be VERY nice though!