There is no standard way, and as far as I know there is no Solaris way either. If there was a reliable way to find out the “ancestor” user, the usual unix security model where root can do everything would not hold.
You can check each process's parent recursively. (Warning, untested script.)
pid=$1 pids=$pid user=
while pid=$(ps -o ppid= $pid); do
user=$(ps -o ruser= $pid)
case $user in
This is not guaranteed to give any result, though. Maybe the parent's parent's parent process has exited.
You can check on what terminal a process is running (
ps -o tty= $pid) and check who last logged in on that terminal (
last). This is only indicative, though: root can start processes on any terminal.
What do you expect to see if user1 runs
su user2 -c 'su user1 -c …'? It's conceivable that the OS would track the successive authentication chains in the kernel data structures associated with the process, but that's very far from the usual unix security model.