cp_mgmt_md_permissions_profile
Manages md-permissions-profile objects on Checkpoint over Web Services API through native controller HTTPAPI with owned sessions
Collection: check_point.mgmt
Full Name: check_point.mgmt.cp_mgmt_md_permissions_profile
Controller module — runs on the local controller, not on remote hosts.
Synopsis
Manages md-permissions-profile objects on Checkpoint over Web Services API through native controller HTTPAPI with owned sessions
Parameters
| Name | Type | Required | Default | Description |
|---|---|---|---|---|
| auto_publish_session | bool | false | Publish this owned session explicitly after the operation; default false. | |
| cme_operations | str | Permission to read / edit the Cloud Management Extension (CME) configuration. | ||
| color | str | Color of the object. Should be one of existing colors. | ||
| comments | str | Comments string. | ||
| default_profile_global_domains | str | Name or UID of the required default profile for all global domains. | ||
| default_profile_local_domains | str | Name or UID of the required default profile for all local domains. | ||
| details_level | str | The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed representation of the object. | ||
| domains_to_process | list | Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System Domain only and with ignore-warnings true. Valid values are, CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER. | ||
| enable_default_profile_for_global_domains | bool | Enable the option to specify a default profile for all global domains. | ||
| enable_default_profile_for_local_domains | bool | Enable the option to specify a default profile for all local domains. | ||
| global_vpn_management | bool | Lets the administrator select Enable global use for a Security Gateway shown in the MDS Gateways & Servers view. Only a ‘Manager’ permission-level profile can edit this permission. | ||
| ignore_errors | bool | Apply changes ignoring errors. You won’t be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored. | ||
| ignore_warnings | bool | Apply changes ignoring warnings. | ||
| manage_admins | bool | Create and manage Multi-Domain Security Management administrators with the same or lower permission level. For example, a Domain manager cannot create Superusers or global managers. Only a ‘Manager’ permission-level profile can edit this permission. | ||
| manage_global_assignments | bool | Controls the ability to create, edit and delete global assignment and not the ability to reassign, which is set according to the specific Domain’s permission profile. | ||
| manage_sessions | bool | Connect/disconnect Domain sessions, publish changes, and delete other administrator sessions. Only a ‘Manager’ permission-level profile can edit this permission. | ||
| management_api_login | bool | Permission to log in to the Security Management Server and run API commands using these tools, mgmt_cli (Linux and Windows binaries), Gaia CLI (clish) and Web Services (REST). Useful if you want to prevent administrators from running automatic scripts on the Management. Note, This permission is not required to run commands from within the API terminal in SmartConsole. | ||
| mds_provisioning | bool | Create and manage Multi-Domain Servers and Multi-Domain Log Servers. Only a “Super User” permission-level profile can select this option. | ||
| name | str | yes | Object name. | |
| permission_level | str | The level of the Multi Domain Permissions Profile. The level cannot be changed after creation. | ||
| state | str | present | Desired object presence. | |
| tags | list | Collection of tag identifiers. | ||
| version | str | Management API version path; omitted uses the default API version. | ||
| view_global_objects_in_domain | bool | Lets an administrator with no global objects permissions view the global objects in the domain. This option is required for valid domain management. | ||
| wait_for_task | bool | true | Wait for returned asynchronous task identifiers; default true. | |
| wait_for_task_timeout | int | 30 | Polling deadline in minutes; default 30, negative values use 30, maximum 1440. |
Example
yaml
- name: add-md-permissions-profile
check_point.mgmt.cp_mgmt_md_permissions_profile:
name: manager profile
state: present
- name: set-md-permissions-profile
check_point.mgmt.cp_mgmt_md_permissions_profile:
default_profile_global_domains: read write all
name: manager profile
permission_level: domain level only
state: present
- name: delete-md-permissions-profile
check_point.mgmt.cp_mgmt_md_permissions_profile:
name: profile
state: absent