Yes, This is exactly what I did.  However something is weird and the policy is not being activated...maybe its a priority thing?

On Friday, November 10, 2017 7:17 AM, Aaron Cole via FreeIPA-users <> wrote:

Did you try the command as defined in the sudo rule?  sudo /usr/bin/su - jira

Also why not just create a sudo rule in IPA with:

Sudo Option:!authenticate
User Groups:developers, ops_sudoers 
Host category: all 
Sudo Allow Commands: all
----->>>RunAs User category:  these will be external users if not controlled through IPA (only on the server), or just select the users and add them
RunAs Group category: all 

They basically can now run any command as that user... to include becoming them with the following command.Which basically you are saying that anyways with su...
sudo -u {user} -i

FreeIPA-users mailing list --
To unsubscribe send an email to