Description of problem:
Local root (on any enrolled IPA-client machines) can become (su) any IPA-user thereby bypassing any security policy rules.

Version-Release number of selected component (if applicable):
IPA 3.0

How reproducible:
Very

Steps to Reproduce:
1. Setup IPA server, enroll an IPA-client machine (PC1)
2. Create a regular user account (bob) on IPA server.
3. Create HBAC policies that prevents bob accessing PC1.
4. Become local root on PC1
5. su bob

Actual results:
Local root on PC1 becomes bob. In fact, local root can become any IPA-managed user even a disabled user.

Expected results:
Local roots should NOT be able to become any user they feel like for accounts that are centrally managed by IPA-server.

Additional info:
The need to grant local root privileges on a machine is a fairly common scenario. This should not compromise the remainder of IPA-managed hosts and accounts.

For example, ActiveDirectory specifically prevents local admins from becoming any domain user they might like. For that they need to be a domain admin. NFS has root_squash to counter a similar scenario where root on one box should not have full access permissions on another exported filesystem. 

This comes down to this: one compromised IPA-client machine could lead to all IPA-managed accounts and hosts becoming vulnerable.