ksu doesn't use my ticket

[Kirk Strauser]

I have a working kdc on my LAN and use OpenSSH's "gssapi-with-mic" 
authentication to connect to other machines.  However, I can't 
use /usr/bin/ksu to su to root without entering root's password, even if I 
have a current, valid ticket and am listed in root's .k5login;

$ sudo cat /root/.k5login
# $FreeBSD: src/etc/root/dot.k5login,v 1.1 2003/04/30 20:58:49 markm Exp $
#
# user1/root at YOUR.REALM.WHEREVER
# user2/root at YOUR.REALM.WHEREVER
kirk at HONEYPOT.NET

$ klist
Credentials cache: FILE:/tmp/krb5cc_1000
        Principal: kirk at HONEYPOT.NET

  Issued           Expires          Principal
Mar 19 13:41:03  Mar 19 23:41:03  krbtgt/HONEYPOT.NET at HONEYPOT.NET

$ ksu
root's password:
Sorry!

Shouldn't that be sufficient to allow me to become root without entering any 
passwords, or am I missing something?  This is somewhat exacerbated by the 
fact that I can't seem to find ksu's man page or other documentation on my 
system.
-- 
Kirk Strauser
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20050319/cfb22d74/attachment.bin