First it should be noted that by using
su ubuntu one would end up using the current user's environment, while what one usually wants to do is to use the target user's environment; so
sudo - ubuntu would be the way to go.
su is not documented enough, but the fact that to login as an user which has no password is not allowed is probably just
To get the equivalent of
su - ubuntu, which would be an interactive login shell as the user ubuntu, one might be tempted to run
sudo su - ubuntu, which wouldn't prompt for a password; however this would be just redundant, since
sudo itself provide this functionality on its own; using
sudo su - ubuntu to get an interactive login shell as the user ubuntu would be exactly the same as running a script A which runs a script B in order to just run the script B.
So, to run an interactive login shell as the user ubuntu, just use
sudo -i -u ubuntu
sudo manpage for Trusty:
Run the shell specified by the target user's password
database entry as a login shell. This means that login-
specific resource files such as .profile or .login will be
read by the shell. If a command is specified, it is passed
to the shell for execution via the shell's -c option. If no
command is specified, an interactive shell is executed. sudo
attempts to change to that user's home directory before
running the shell. The command is run with an environment
similar to the one a user would receive at log in. The
Command Environment section in the sudoers(5) manual
documents how the -i option affects the environment in which
a command is run when the sudoers policy is in use.
-u user, --user=user
Run the command as a user other than the default target user
(usually root ). The user may be either a user name or a
numeric user ID (UID) prefixed with the ‘#’ character (e.g.
#0 for UID 0). When running commands as a UID, many shells
require that the ‘#’ be escaped with a backslash (‘\’). Some
security policies may restrict UIDs to those listed in the
password database. The sudoers policy allows UIDs that are
not in the password database as long as the targetpw option
is not set. Other security policies may not support this.