I edited sudoers by hand however it should give you something to aim towards ...
[root@orable76 ~]# grep angus /etc/sudoers
angus ALL=NOPASSWD: /usr/bin/su - appuser
[root@orable76 ~]# su - angus
Last login: Fri Jan 22 17:01:30 CET 2021 on pts/0
[angus@orable76 ~]$ sudo su - appuser
Last login: Fri Jan 22 17:01:31 CET 2021 on pts/0
From: Russ Long via FreeIPA-users <email@example.com> Sent: 22 January 2021 16:33 To: firstname.lastname@example.org <email@example.com> Cc: Russ Long <firstname.lastname@example.org> Subject: [Freeipa-users] Allow "sudo su - USER" to only the specified user
I'm trying to come up with a Sudo rule that will allow a user to "su" to only a single specified user. I need to give a DBA access to the oracle user account.
This serverfault article details exactly what I want to do, however this is not for FreeIPA.
I've tried creating a sudo command that's "/usr/bin/su - USER" and other variations to no avail.