Unless you have some really strange custom PAM modules, there's no way that "su" is prompting for a password when run as root. By using
su - user -c ... with a dash(-) instead of using
su user -c ..., your boot script is processing their start-up "dot" files. It's probably that something in their dot files is invoking another
su or that the invoked command is actually doing another
On a related note, for many scripts, it's helpful to put in a line reading
exec < /dev/null. This will prevent any attempt to read standard input for most things. This may not help for boot scripts and
su though, because unless I misremembering, the Solaris 8
su will grab the terminal instead of stdin.
Check the dot files. And try removing the "-" from
su so that they aren't processed. If you have any settings that need to be visible for both interactive use and use by the boot script, consider putting just those settings into a so-called environment file. The dot files and the boot script can then both source the environment file. The settings in the environment file will probably change rarely and your boot process is less likely to be impacted by someone munging the dot files.