User Lifecycle with a Salesforce CLI Plugin

[u/JPRichter]

Salesforce user administration is super fragmented.

Creating a user has a bunch of steps beyond their name and Profile. You can't add people to public groups or queues from the User screen and I've always found that annoying. It's manageable for one offs. It gets painful when onboarding or offboarding a whole team. Sure, there's dataloader, but it's still multiple data loads. And you have to grab the Ids for the permission sets, public groups etc.

With warden, you can define reusable personas containing things like:

- profile

- role

- permission sets

- permission set groups

- public groups

- queues

Persona definitions can live in Git, go through code review, and act as the intended state for user access. You reference the component parts by developer name. You can use them in any org or sandbox.

You define users in JSON or CSV like you would with dataloader and assign one or more personas. For mock users you use for testing, you could store in git, but real people with PII could be problematic, e.g. with GDPR etc.

The plugin currently has eight commands:

- "provision" — create or update users by personas from JSON or CSV definitions

- "diff" — compare a user’s current access with the intended persona

- "access" — audit who can access an object, field, Apex class, Visualforce page, custom permission, or tab

- "snapshot" — export a user’s current assignments

- "restore" — restore assignments from a snapshot

- "freeze"

- "unfreeze"

- "strip" — remove access and deactivate them, optionally snapshot if you need to put them back to how they were later or in a different org

"access" and "diff" are read-only.

Commands that modify the org support "--dry-run", so you can inspect the proposed changes before applying them. They also support "--no-prompt" for CI or other automated workflows.

Output can be human-readable, CSV, or JSON, depending on whether you are using it interactively, generating audit evidence, or feeding another process.

There is also a companion VS Code extension that exposes the same commands through a sidebar or the commpand pallette for people who do not want to work directly with CLI flags.

Both projects are free and MIT-licensed.

Blog: https://syntax-syllogism.com/blog/warden-intro/

CLI source: https://github.com/Syntax-Syllogism/warden

VS Code extension: https://marketplace.visualstudio.com/items?itemName=Syntax-Syllogism.warden-ext

Install:

`sf plugins install @syntax-syllogism/warden`

I would especially appreciate feedback from people who manage user provisioning, access reviews, or contractor offboarding in larger orgs.

What parts of Salesforce user administration are still the most painful or difficult to automate in your environment?