sudo access on ipa client does not work

Hi
I set up the sudo for ipa group user and add the changes in the sudo-ldap.conf file, but the sudo always asks for a sudo su pass password - {user} asks for the password

creating a user ok password change request at the first login works well but sudo always asks for password

someone can help me