Yes, This is exactly what I did.  However something is weird and the policy is not being activated...maybe its a priority thing?


On Friday, November 10, 2017 7:17 AM, Aaron Cole via FreeIPA-users <freeipa-users@lists.fedorahosted.org> wrote:


Did you try the command as defined in the sudo rule?  sudo /usr/bin/su - jira

Also why not just create a sudo rule in IPA with:

Sudo Option:!authenticate
User Groups:developers, ops_sudoers 
Host category: all 
Sudo Allow Commands: all
----->>>RunAs User category:  these will be external users if not controlled through IPA (only on the server), or just select the users and add them
RunAs Group category: all 

They basically can now run any command as that user... to include becoming them with the following command.Which basically you are saying that anyways with su...
sudo -u {user} -i

_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org