I edited sudoers by hand however it should give you something to aim towards ...
[root@orable76 ~]# grep angus /etc/sudoers
angus ALL=NOPASSWD: /usr/bin/su - appuser
[root@orable76 ~]# su - angus
Last login: Fri Jan 22 17:01:30 CET 2021 on pts/0
[angus@orable76 ~]$ sudo su - appuser
Last login: Fri Jan 22 17:01:31 CET 2021 on pts/0
[appuser@orable76 ~]$
Regards
Angus
From: Russ Long via FreeIPA-users <freeipa-users@lists.fedorahosted.org> Sent: 22 January 2021 16:33 To: freeipa-users@lists.fedorahosted.org <freeipa-users@lists.fedorahosted.org> Cc: Russ Long <kd8fre@gmail.com> Subject: [Freeipa-users] Allow "sudo su - USER" to only the specified user
I'm trying to come up with a Sudo rule that will allow a user to "su" to only a single specified user. I need to give a DBA access to the oracle user account.
This serverfault article details exactly what I want to do, however this is not for FreeIPA.
I've tried creating a sudo command that's "/usr/bin/su - USER" and other variations to no avail.