git: b36435210a1e - stable/15 - krb5: Enable PRINC_LOOK_AHEAD in ksu

The branch stable/15 has been updated by cy:

URL: https://cgit.FreeBSD.org/src/commit/?id=b36435210a1e07b2704f65f6c69c0645ac2e5657

commit b36435210a1e07b2704f65f6c69c0645ac2e5657
Author:     Cy Schubert <cy@FreeBSD.org>
AuthorDate: 2025-09-10 20:13:08 +0000
Commit:     Cy Schubert <cy@FreeBSD.org>
CommitDate: 2025-09-14 15:20:53 +0000

    krb5: Enable PRINC_LOOK_AHEAD in ksu
    
    PRINC_LOOK_AHEAD is the upstream default. Normally ksu determines the
    target princiapl by (quoted from the man page)
    
    a. default principal of the source cache
    
    b. target_user@local_realm
    
    c. source_user@local_realm
    
    With PRINC_LOOK_AHEAD emabled, for each candidate in the above
    list, select an authorized principal that has the same realm name
    and first part of the principal name equal to the prefix of the
    candidate. For example if candidate a) is jqpublic@ISI.EDU and
    jqpublic/secure@ISI.EDU is authorized to access the target account
    then the default principal is set to jqpublic/secure@ISI.EDU.
    
    Case 2: source user is root.
    
    If the target user is non-root then the default principal name
    is target_user@local_realm.  Else, if the source cache exists
    the default principal name is set to the default principal of
    the source cache.  If the source cache does not exist, default
    principal name is set to root\@local_realm.
    
    This commit restores the same behaviour as Heimdal ksu.
    
    Reported by:            Dan Mahoney <dmahoney@isc.org>
    Requested by:           Dan Mahoney <dmahoney@isc.org>
    Differential revision:   https://reviews.freebsd.org/D52478
    
    (cherry picked from commit b0e7b55a0e90d737cf469b78e9785b492b3c0d0f)
---
 krb5/usr.bin/ksu/Makefile | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/krb5/usr.bin/ksu/Makefile b/krb5/usr.bin/ksu/Makefile
index aaec461ce0b0..93860e38ce5c 100644
--- a/krb5/usr.bin/ksu/Makefile
+++ b/krb5/usr.bin/ksu/Makefile
@@ -24,7 +24,8 @@ SRCS=	authorization.c \
 
 CFLAGS+=-I${KRB5_DIR}/include \
 	-I${KRB5_SRCTOP}/include \
-	-DGET_TGT_VIA_PASSWD
+	-DGET_TGT_VIA_PASSWD \
+	-DPRINC_LOOK_AHEAD
 
 MAN=	ksu.1