Hey folks! Anyone who has worked with Salesforce Community Cloud has likely seen that there are several tiers of licenses (for both portals and community cloud) that can be used to create community users from a Contact or Person Account record. Some of those licenses have roles, and others do not. The breakdown of licenses looks a bit like this:

Role-based licenses use traditional Salesforce sharing rules: role-based sharing rules, criteria-based sharing rules, and manual/Apex sharing to get users access to records. But role-based licenses can only scale so far, so for communities with large numbers of users (several hundred thousand or more), there are High Volume licenses that use Sharing Sets (http://help.salesforce.com/apex/HTViewHelpDoc?id=customer_portal_sharing_set.htm&language=en_US) instead of roles to grant access to records. These licenses scale to even greater heights, into the millions of users.

But if you've ever tried to take an existing user with, say, a high volume license and tried to move them to a role-based license (because they may need dashboards or delegated administration, for example) you may have noticed that you cannot simply edit the user and change the license:

The underlying licensing system prevents you from doing this because the two licenses are so fundamentally different. To move someone from a high volume license to a role-based license, you need to disable and re-create the user from the contact record. Here's what doing that manually looks like:

NOTE: Doing this will simply create a new user. It will not move record ownership, nor will it migrate chatter posts to this new user. It simply recreates the user under the Contact (or Person Account) record.

Scaling The Migration
Doing this for a few users usually isn't too difficult, but when there are many users, some form of automation would be useful. I realized the other day that this might be painful for customers, so I thought I'd try my hand at writing an Apex utility class that does this in an automated manner. The results are downloadable in the Success Community here:
UserProvisioningUtils (Zip) (https://success.salesforce.com/06930000005LVBL)

This class is sample code only, and is not guaranteed to work in all environments, but I've successfully used it to disable and re-create an individual user on a certain license type.

Using the Code
I've tried to make this code easy to use. You basically need the Salesforce Id of the existing portal or community user (who should be on a high volume license), as well as the Salesforce Ids of the new role and profiles you'd like the new user to have. 

String existingUserId = '00515000005bjHr';
String newProfileId = '00e150000019PBD';
String newRoleId = '00E15000001BINl';
UserProvisioningUtils utils = new UserProvisioningUtils(existingUserId, newProfileId, newRoleId);

That's it...simply running this code (as part of another Apex class or in the execute anonymous window of the Developer Console) should do the following:

• Disable the existing user.
• Copy the appropriate values for user Id, nickname, etc
• Create the new community user on the designated profile and role. 

It would seem like a fairly simple thing to do, but there were some interesting nuances around the number of DML operations one can do in a single Apex statement. For those inspecting the code, you'll see the use of the @future annotation to get around that.

Hope this helps folks!