foreman-rake is designed to be run as root (and switch to foreman) or by foreman directly. any other user can't use it as it is installed in sbin and the foreman user has no password set, making switching users as non root impossible, but su will still try it:

    [nobody@foreman /]$ su foreman -s /bin/bash -c id
    Password:
    [nobody@foreman /]$ foreman-rake console
    Password:

runuser is designed to be used in scripts and refuses to work as non root:

    [nobody@foreman /]$ runuser foreman -s /bin/bash -c id
    runuser: may not be used by non-root users
    [nobody@foreman /]$ foreman-rake console
    runuser: may not be used by non-root users