Let postgresql (libpq.so) only link with the Kerberos implementations

installed from ports. The base heimdal distribution installs libraries
that have no depenency information. While this is quite correct, it
means that each library that links with libpq.so must also know if
libpq.so is linked with libkrb.so et al. Problem is, there's no good
way to get this information (pg_config has a --libs option starting at
version 8.1) and all ports using postgresql must be changed to make it
possible to link with a libpq.so that was configured to use the
Kerberos implementation installed in /usr by default. Hence, we
require one of the ports (heimdal or krb5) if postgresql is to be
linked with Kerberos. At least for now, until we can fix this in some
better way.

Also, if MIT Kerberos (security/krb5) is installed, users should
ideally remove the base heimdal installation so linkers will not pick
it up in preference to the krb5 libs (base heimdal has higher version
numbers than krb5 port).

PR: 80869, 88098, 85178

10 files changed, 170 insertions, 162 deletions

diff --git a/databases/postgresql73-server/Makefile b/databases/postgresql73-server/Makefile
index 84270b7b2e05..f3e7d223796b 100644
--- a/databases/postgresql73-server/Makefile
+++ b/databases/postgresql73-server/Makefile
@@ -116,30 +116,31 @@ INSTALL_TARGET=	install-strip
 .  endif
 
 .  if defined(WITH_MIT_KRB5)
-WITH_KRB5=	yes
-KRB5_HOME?=	${LOCALBASE}
-KRB5CONF=	${KRB5_HOME}/bin/krb5-config
+.    if exists(/usr/lib/libkrb5.so) || exists(/usr/bin/krb5-config)
+BROKEN=		"You must remove heimdal's /usr/bin/krb5-config and /usr/lib/libkrb5.so*, and set NO_KERBEROS=true in /etc/make.conf to build successfully with MIT-KRB"
+.    endif
+# Allow defining a home built MIT Kerberos by setting KRB5_HOME
+.    if defined(KRB5_HOME) && exists(${KRB5_HOME}/lib/libgssapi_krb5.a) && exists(${KRB5_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5=${KRB5_HOME}
+.    else
 LIB_DEPENDS+=	krb5.3:${PORTSDIR}/security/krb5
+CONFIGURE_ARGS+=--with-krb5=${LOCALBASE}
+.    endif
 .  endif
 
 .  if defined(WITH_HEIMDAL_KRB5)
-WITH_KRB5=	yes
-.    if defined(HEIMDAL_HOME) && exists(${HEIMDAL_HOME}/lib/libgssapi.a)
-KRB5CONF=	${HEIMDAL_HOME}/bin/krb5-config
-.    elif ( ${OSVERSION} > 500105 ) && exists(${DESTDIR}/usr/lib/libkrb5.a)
-KRB5CONF=	${DESTDIR}/usr/bin/krb5-config
+# Allow defining a home built Heimdal Kerberos by setting HEIMDAL_HOME
+.    if defined(HEIMDAL_HOME) && exists(${HEIMDAL_HOME}/lib/libgssapi.a) && exists(${HEIMDAL_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5=${HEIMDAL_HOME}
 .    else
-LIB_DEPENDS+=	krb5:${PORTSDIR}/security/heimdal
-KRB5CONF=	${LOCALBASE}/bin/krb5-config
+# Postgresql apps will not link properly when libpq is linked with base heimdal in /usr,
+# so we always use the heimdal port. See
+# http://lists.freebsd.org/pipermail/freebsd-stable/2005-October/018809.html
+LIB_DEPENDS+=	krb5.20:${PORTSDIR}/security/heimdal
+CONFIGURE_ARGS+=--with-krb5=${LOCALBASE}
 .    endif
 .  endif
 
-.  if defined(WITH_KRB5)
-CONFIGURE_ARGS+=	--with-krb5="`${KRB5CONF} --prefix krb5`"
-LDFLAGS+=	`${KRB5CONF} --libs krb5`
-CONFIGURE_ENV+=	LDFLAGS="${LDFLAGS}"
-.  endif
-
 .  if defined(SERVER_ONLY) && defined(WITH_TESTS)
 DISTFILES+=	postgresql-test-${PORTVERSION}${EXTRACT_SUFX}
 EXTRA_PATCHES=	${FILESDIR}/regresspatch-src-test-regress-pgregress-sh
diff --git a/databases/postgresql74-server/Makefile b/databases/postgresql74-server/Makefile
index 78a778064fd5..afbf6b78ba29 100644
--- a/databases/postgresql74-server/Makefile
+++ b/databases/postgresql74-server/Makefile
@@ -116,30 +116,31 @@ INSTALL_TARGET=	install-strip
 .  endif
 
 .  if defined(WITH_MIT_KRB5)
-WITH_KRB5=	yes
-KRB5_HOME?=	${LOCALBASE}
-KRB5CONF=	${KRB5_HOME}/bin/krb5-config
+.    if exists(/usr/lib/libkrb5.so) || exists(/usr/bin/krb5-config)
+BROKEN=		"You must remove heimdal's /usr/bin/krb5-config and /usr/lib/libkrb5.so*, and set NO_KERBEROS=true in /etc/make.conf to build successfully with MIT-KRB"
+.    endif
+# Allow defining a home built MIT Kerberos by setting KRB5_HOME
+.    if defined(KRB5_HOME) && exists(${KRB5_HOME}/lib/libgssapi_krb5.a) && exists(${KRB5_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5=${KRB5_HOME}
+.    else
 LIB_DEPENDS+=	krb5.3:${PORTSDIR}/security/krb5
+CONFIGURE_ARGS+=--with-krb5=${LOCALBASE}
+.    endif
 .  endif
 
 .  if defined(WITH_HEIMDAL_KRB5)
-WITH_KRB5=	yes
-.    if defined(HEIMDAL_HOME) && exists(${HEIMDAL_HOME}/lib/libgssapi.a)
-KRB5CONF=	${HEIMDAL_HOME}/bin/krb5-config
-.    elif ( ${OSVERSION} > 500105 ) && exists(${DESTDIR}/usr/lib/libkrb5.a)
-KRB5CONF=	${DESTDIR}/usr/bin/krb5-config
+# Allow defining a home built Heimdal Kerberos by setting HEIMDAL_HOME
+.    if defined(HEIMDAL_HOME) && exists(${HEIMDAL_HOME}/lib/libgssapi.a) && exists(${HEIMDAL_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5=${HEIMDAL_HOME}
 .    else
-LIB_DEPENDS+=	krb5:${PORTSDIR}/security/heimdal
-KRB5CONF=	${LOCALBASE}/bin/krb5-config
+# Postgresql apps will not link properly when libpq is linked with base heimdal in /usr,
+# so we always use the heimdal port. See
+# http://lists.freebsd.org/pipermail/freebsd-stable/2005-October/018809.html
+LIB_DEPENDS+=	krb5.20:${PORTSDIR}/security/heimdal
+CONFIGURE_ARGS+=--with-krb5=${LOCALBASE}
 .    endif
 .  endif
 
-.  if defined(WITH_KRB5)
-CONFIGURE_ARGS+=	--with-krb5="`${KRB5CONF} --prefix krb5`"
-LDFLAGS+=	`${KRB5CONF} --libs krb5`
-CONFIGURE_ENV+=	LDFLAGS="${LDFLAGS}"
-.  endif
-
 .  if defined(SERVER_ONLY) && defined(WITH_TESTS)
 DISTFILES+=	postgresql-test-${PORTVERSION}${EXTRACT_SUFX}
 EXTRA_PATCHES=	${FILESDIR}/regresspatch-src-test-regress-pgregress-sh
diff --git a/databases/postgresql80-server/Makefile b/databases/postgresql80-server/Makefile
index adb368c71206..1eb38d45f43b 100644
--- a/databases/postgresql80-server/Makefile
+++ b/databases/postgresql80-server/Makefile
@@ -150,30 +150,29 @@ INSTALL_TARGET=	install-strip
 .  endif
 
 .  if defined(WITH_MIT_KRB5)
-WITH_KRB5=	yes
-KRB5_HOME?=	${LOCALBASE}
-KRB5CONF=	${KRB5_HOME}/bin/krb5-config
+.    if exists(/usr/lib/libkrb5.so) || exists(/usr/bin/krb5-config)
+BROKEN=		"You must remove heimdal's /usr/bin/krb5-config and /usr/lib/libkrb5.so*, and set NO_KERBEROS=true in /etc/make.conf to build successfully with MIT-KRB"
+.    endif
+# Allow defining a home built MIT Kerberos by setting KRB5_HOME
+.    if defined(KRB5_HOME) && exists(${KRB5_HOME}/lib/libgssapi_krb5.a) && exists(${KRB5_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
 LIB_DEPENDS+=	krb5.3:${PORTSDIR}/security/krb5
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(WITH_HEIMDAL_KRB5)
-WITH_KRB5=	yes
-.    if defined(HEIMDAL_HOME) && exists(${HEIMDAL_HOME}/lib/libgssapi.a)
-KRB5CONF=	${HEIMDAL_HOME}/bin/krb5-config
-.    elif ( defined(MAKE_KERBEROS5) || ${OSVERSION} > 500105 ) && exists(${DESTDIR}/usr/lib/libkrb5.a)
-KRB5CONF=	${DESTDIR}/usr/bin/krb5-config
+# Allow defining a home built Heimdal Kerberos by setting HEIMDAL_HOME
+.    if defined(HEIMDAL_HOME) && exists(${HEIMDAL_HOME}/lib/libgssapi.a) && exists(${HEIMDAL_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
 .    else
-LIB_DEPENDS+=	krb5:${PORTSDIR}/security/heimdal
-KRB5CONF=	${LOCALBASE}/bin/krb5-config
-.    endif
-.  endif
-
-.  if defined(WITH_KRB5)
+# Postgresql apps will not link properly when libpq is linked with base heimdal in /usr,
+# so we always use the heimdal port. See
+# http://lists.freebsd.org/pipermail/freebsd-stable/2005-October/018809.html
+LIB_DEPENDS+=	krb5.20:${PORTSDIR}/security/heimdal
 CONFIGURE_ARGS+=--with-krb5
-LIBS+=		`${KRB5CONF} --libs krb5`
-CONFIGURE_ENV+=	LIBS="${LIBS}" LDFLAGS="${LIBS}"
-.  else
-CONFIGURE_ARGS+=--without-krb5
+.    endif
 .  endif
 
 .  if defined(SERVER_ONLY) && defined(WITH_TESTS)
diff --git a/databases/postgresql81-server/Makefile b/databases/postgresql81-server/Makefile
index a8c6aad8b867..171f826d37a5 100644
--- a/databases/postgresql81-server/Makefile
+++ b/databases/postgresql81-server/Makefile
@@ -150,28 +150,29 @@ INSTALL_TARGET=	install-strip
 .  endif
 
 .  if defined(WITH_MIT_KRB5)
-.    if exists(/usr/lib/libkrb5.so)
-BROKEN=		"You must remove heimdal's /usr/lib/libkrb5.so* to build successfully with MIT-KRB"
+.    if exists(/usr/lib/libkrb5.so) || exists(/usr/bin/krb5-config)
+BROKEN=		"You must remove heimdal's /usr/bin/krb5-config and /usr/lib/libkrb5.so*, and set NO_KERBEROS=true in /etc/make.conf to build successfully with MIT-KRB"
 .    endif
-WITH_KRB5=	yes
-KRB5_HOME?=	${LOCALBASE}
-KRB5CONF=	${KRB5_HOME}/bin/krb5-config
+# Allow defining a home built MIT Kerberos by setting KRB5_HOME
+.    if defined(KRB5_HOME) && exists(${KRB5_HOME}/lib/libgssapi_krb5.a) && exists(${KRB5_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
 LIB_DEPENDS+=	krb5.3:${PORTSDIR}/security/krb5
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(WITH_HEIMDAL_KRB5)
-WITH_KRB5=	yes
-# Base heimdal in /usr will not link properly with postgresql, we must
-# use the port. See
+# Allow defining a home built Heimdal Kerberos by setting HEIMDAL_HOME
+.    if defined(HEIMDAL_HOME) && exists(${HEIMDAL_HOME}/lib/libgssapi.a) && exists(${HEIMDAL_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
+# Postgresql apps will not link properly when libpq is linked with base heimdal in /usr,
+# so we always use the heimdal port. See
 # http://lists.freebsd.org/pipermail/freebsd-stable/2005-October/018809.html
-LIB_DEPENDS+=	krb5:${PORTSDIR}/security/heimdal
-KRB5CONF=	${LOCALBASE}/bin/krb5-config
-.  endif
-
-.  if defined(WITH_KRB5)
-CONFIGURE_ARGS+=	--with-krb5
-LIBS=		`${KRB5CONF} --libs krb5`
-CONFIGURE_ENV+=	LIBS="${LIBS}"
+LIB_DEPENDS+=	krb5.20:${PORTSDIR}/security/heimdal
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(SERVER_ONLY) && defined(WITH_TESTS)
diff --git a/databases/postgresql82-server/Makefile b/databases/postgresql82-server/Makefile
index a8c6aad8b867..171f826d37a5 100644
--- a/databases/postgresql82-server/Makefile
+++ b/databases/postgresql82-server/Makefile
@@ -150,28 +150,29 @@ INSTALL_TARGET=	install-strip
 .  endif
 
 .  if defined(WITH_MIT_KRB5)
-.    if exists(/usr/lib/libkrb5.so)
-BROKEN=		"You must remove heimdal's /usr/lib/libkrb5.so* to build successfully with MIT-KRB"
+.    if exists(/usr/lib/libkrb5.so) || exists(/usr/bin/krb5-config)
+BROKEN=		"You must remove heimdal's /usr/bin/krb5-config and /usr/lib/libkrb5.so*, and set NO_KERBEROS=true in /etc/make.conf to build successfully with MIT-KRB"
 .    endif
-WITH_KRB5=	yes
-KRB5_HOME?=	${LOCALBASE}
-KRB5CONF=	${KRB5_HOME}/bin/krb5-config
+# Allow defining a home built MIT Kerberos by setting KRB5_HOME
+.    if defined(KRB5_HOME) && exists(${KRB5_HOME}/lib/libgssapi_krb5.a) && exists(${KRB5_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
 LIB_DEPENDS+=	krb5.3:${PORTSDIR}/security/krb5
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(WITH_HEIMDAL_KRB5)
-WITH_KRB5=	yes
-# Base heimdal in /usr will not link properly with postgresql, we must
-# use the port. See
+# Allow defining a home built Heimdal Kerberos by setting HEIMDAL_HOME
+.    if defined(HEIMDAL_HOME) && exists(${HEIMDAL_HOME}/lib/libgssapi.a) && exists(${HEIMDAL_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
+# Postgresql apps will not link properly when libpq is linked with base heimdal in /usr,
+# so we always use the heimdal port. See
 # http://lists.freebsd.org/pipermail/freebsd-stable/2005-October/018809.html
-LIB_DEPENDS+=	krb5:${PORTSDIR}/security/heimdal
-KRB5CONF=	${LOCALBASE}/bin/krb5-config
-.  endif
-
-.  if defined(WITH_KRB5)
-CONFIGURE_ARGS+=	--with-krb5
-LIBS=		`${KRB5CONF} --libs krb5`
-CONFIGURE_ENV+=	LIBS="${LIBS}"
+LIB_DEPENDS+=	krb5.20:${PORTSDIR}/security/heimdal
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(SERVER_ONLY) && defined(WITH_TESTS)
diff --git a/databases/postgresql83-server/Makefile b/databases/postgresql83-server/Makefile
index a8c6aad8b867..171f826d37a5 100644
--- a/databases/postgresql83-server/Makefile
+++ b/databases/postgresql83-server/Makefile
@@ -150,28 +150,29 @@ INSTALL_TARGET=	install-strip
 .  endif
 
 .  if defined(WITH_MIT_KRB5)
-.    if exists(/usr/lib/libkrb5.so)
-BROKEN=		"You must remove heimdal's /usr/lib/libkrb5.so* to build successfully with MIT-KRB"
+.    if exists(/usr/lib/libkrb5.so) || exists(/usr/bin/krb5-config)
+BROKEN=		"You must remove heimdal's /usr/bin/krb5-config and /usr/lib/libkrb5.so*, and set NO_KERBEROS=true in /etc/make.conf to build successfully with MIT-KRB"
 .    endif
-WITH_KRB5=	yes
-KRB5_HOME?=	${LOCALBASE}
-KRB5CONF=	${KRB5_HOME}/bin/krb5-config
+# Allow defining a home built MIT Kerberos by setting KRB5_HOME
+.    if defined(KRB5_HOME) && exists(${KRB5_HOME}/lib/libgssapi_krb5.a) && exists(${KRB5_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
 LIB_DEPENDS+=	krb5.3:${PORTSDIR}/security/krb5
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(WITH_HEIMDAL_KRB5)
-WITH_KRB5=	yes
-# Base heimdal in /usr will not link properly with postgresql, we must
-# use the port. See
+# Allow defining a home built Heimdal Kerberos by setting HEIMDAL_HOME
+.    if defined(HEIMDAL_HOME) && exists(${HEIMDAL_HOME}/lib/libgssapi.a) && exists(${HEIMDAL_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
+# Postgresql apps will not link properly when libpq is linked with base heimdal in /usr,
+# so we always use the heimdal port. See
 # http://lists.freebsd.org/pipermail/freebsd-stable/2005-October/018809.html
-LIB_DEPENDS+=	krb5:${PORTSDIR}/security/heimdal
-KRB5CONF=	${LOCALBASE}/bin/krb5-config
-.  endif
-
-.  if defined(WITH_KRB5)
-CONFIGURE_ARGS+=	--with-krb5
-LIBS=		`${KRB5CONF} --libs krb5`
-CONFIGURE_ENV+=	LIBS="${LIBS}"
+LIB_DEPENDS+=	krb5.20:${PORTSDIR}/security/heimdal
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(SERVER_ONLY) && defined(WITH_TESTS)
diff --git a/databases/postgresql84-server/Makefile b/databases/postgresql84-server/Makefile
index a8c6aad8b867..171f826d37a5 100644
--- a/databases/postgresql84-server/Makefile
+++ b/databases/postgresql84-server/Makefile
@@ -150,28 +150,29 @@ INSTALL_TARGET=	install-strip
 .  endif
 
 .  if defined(WITH_MIT_KRB5)
-.    if exists(/usr/lib/libkrb5.so)
-BROKEN=		"You must remove heimdal's /usr/lib/libkrb5.so* to build successfully with MIT-KRB"
+.    if exists(/usr/lib/libkrb5.so) || exists(/usr/bin/krb5-config)
+BROKEN=		"You must remove heimdal's /usr/bin/krb5-config and /usr/lib/libkrb5.so*, and set NO_KERBEROS=true in /etc/make.conf to build successfully with MIT-KRB"
 .    endif
-WITH_KRB5=	yes
-KRB5_HOME?=	${LOCALBASE}
-KRB5CONF=	${KRB5_HOME}/bin/krb5-config
+# Allow defining a home built MIT Kerberos by setting KRB5_HOME
+.    if defined(KRB5_HOME) && exists(${KRB5_HOME}/lib/libgssapi_krb5.a) && exists(${KRB5_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
 LIB_DEPENDS+=	krb5.3:${PORTSDIR}/security/krb5
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(WITH_HEIMDAL_KRB5)
-WITH_KRB5=	yes
-# Base heimdal in /usr will not link properly with postgresql, we must
-# use the port. See
+# Allow defining a home built Heimdal Kerberos by setting HEIMDAL_HOME
+.    if defined(HEIMDAL_HOME) && exists(${HEIMDAL_HOME}/lib/libgssapi.a) && exists(${HEIMDAL_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
+# Postgresql apps will not link properly when libpq is linked with base heimdal in /usr,
+# so we always use the heimdal port. See
 # http://lists.freebsd.org/pipermail/freebsd-stable/2005-October/018809.html
-LIB_DEPENDS+=	krb5:${PORTSDIR}/security/heimdal
-KRB5CONF=	${LOCALBASE}/bin/krb5-config
-.  endif
-
-.  if defined(WITH_KRB5)
-CONFIGURE_ARGS+=	--with-krb5
-LIBS=		`${KRB5CONF} --libs krb5`
-CONFIGURE_ENV+=	LIBS="${LIBS}"
+LIB_DEPENDS+=	krb5.20:${PORTSDIR}/security/heimdal
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(SERVER_ONLY) && defined(WITH_TESTS)
diff --git a/databases/postgresql90-server/Makefile b/databases/postgresql90-server/Makefile
index a8c6aad8b867..171f826d37a5 100644
--- a/databases/postgresql90-server/Makefile
+++ b/databases/postgresql90-server/Makefile
@@ -150,28 +150,29 @@ INSTALL_TARGET=	install-strip
 .  endif
 
 .  if defined(WITH_MIT_KRB5)
-.    if exists(/usr/lib/libkrb5.so)
-BROKEN=		"You must remove heimdal's /usr/lib/libkrb5.so* to build successfully with MIT-KRB"
+.    if exists(/usr/lib/libkrb5.so) || exists(/usr/bin/krb5-config)
+BROKEN=		"You must remove heimdal's /usr/bin/krb5-config and /usr/lib/libkrb5.so*, and set NO_KERBEROS=true in /etc/make.conf to build successfully with MIT-KRB"
 .    endif
-WITH_KRB5=	yes
-KRB5_HOME?=	${LOCALBASE}
-KRB5CONF=	${KRB5_HOME}/bin/krb5-config
+# Allow defining a home built MIT Kerberos by setting KRB5_HOME
+.    if defined(KRB5_HOME) && exists(${KRB5_HOME}/lib/libgssapi_krb5.a) && exists(${KRB5_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
 LIB_DEPENDS+=	krb5.3:${PORTSDIR}/security/krb5
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(WITH_HEIMDAL_KRB5)
-WITH_KRB5=	yes
-# Base heimdal in /usr will not link properly with postgresql, we must
-# use the port. See
+# Allow defining a home built Heimdal Kerberos by setting HEIMDAL_HOME
+.    if defined(HEIMDAL_HOME) && exists(${HEIMDAL_HOME}/lib/libgssapi.a) && exists(${HEIMDAL_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
+# Postgresql apps will not link properly when libpq is linked with base heimdal in /usr,
+# so we always use the heimdal port. See
 # http://lists.freebsd.org/pipermail/freebsd-stable/2005-October/018809.html
-LIB_DEPENDS+=	krb5:${PORTSDIR}/security/heimdal
-KRB5CONF=	${LOCALBASE}/bin/krb5-config
-.  endif
-
-.  if defined(WITH_KRB5)
-CONFIGURE_ARGS+=	--with-krb5
-LIBS=		`${KRB5CONF} --libs krb5`
-CONFIGURE_ENV+=	LIBS="${LIBS}"
+LIB_DEPENDS+=	krb5.20:${PORTSDIR}/security/heimdal
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(SERVER_ONLY) && defined(WITH_TESTS)
diff --git a/databases/postgresql91-server/Makefile b/databases/postgresql91-server/Makefile
index a8c6aad8b867..171f826d37a5 100644
--- a/databases/postgresql91-server/Makefile
+++ b/databases/postgresql91-server/Makefile
@@ -150,28 +150,29 @@ INSTALL_TARGET=	install-strip
 .  endif
 
 .  if defined(WITH_MIT_KRB5)
-.    if exists(/usr/lib/libkrb5.so)
-BROKEN=		"You must remove heimdal's /usr/lib/libkrb5.so* to build successfully with MIT-KRB"
+.    if exists(/usr/lib/libkrb5.so) || exists(/usr/bin/krb5-config)
+BROKEN=		"You must remove heimdal's /usr/bin/krb5-config and /usr/lib/libkrb5.so*, and set NO_KERBEROS=true in /etc/make.conf to build successfully with MIT-KRB"
 .    endif
-WITH_KRB5=	yes
-KRB5_HOME?=	${LOCALBASE}
-KRB5CONF=	${KRB5_HOME}/bin/krb5-config
+# Allow defining a home built MIT Kerberos by setting KRB5_HOME
+.    if defined(KRB5_HOME) && exists(${KRB5_HOME}/lib/libgssapi_krb5.a) && exists(${KRB5_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
 LIB_DEPENDS+=	krb5.3:${PORTSDIR}/security/krb5
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(WITH_HEIMDAL_KRB5)
-WITH_KRB5=	yes
-# Base heimdal in /usr will not link properly with postgresql, we must
-# use the port. See
+# Allow defining a home built Heimdal Kerberos by setting HEIMDAL_HOME
+.    if defined(HEIMDAL_HOME) && exists(${HEIMDAL_HOME}/lib/libgssapi.a) && exists(${HEIMDAL_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
+# Postgresql apps will not link properly when libpq is linked with base heimdal in /usr,
+# so we always use the heimdal port. See
 # http://lists.freebsd.org/pipermail/freebsd-stable/2005-October/018809.html
-LIB_DEPENDS+=	krb5:${PORTSDIR}/security/heimdal
-KRB5CONF=	${LOCALBASE}/bin/krb5-config
-.  endif
-
-.  if defined(WITH_KRB5)
-CONFIGURE_ARGS+=	--with-krb5
-LIBS=		`${KRB5CONF} --libs krb5`
-CONFIGURE_ENV+=	LIBS="${LIBS}"
+LIB_DEPENDS+=	krb5.20:${PORTSDIR}/security/heimdal
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(SERVER_ONLY) && defined(WITH_TESTS)
diff --git a/databases/postgresql92-server/Makefile b/databases/postgresql92-server/Makefile
index a8c6aad8b867..171f826d37a5 100644
--- a/databases/postgresql92-server/Makefile
+++ b/databases/postgresql92-server/Makefile
@@ -150,28 +150,29 @@ INSTALL_TARGET=	install-strip
 .  endif
 
 .  if defined(WITH_MIT_KRB5)
-.    if exists(/usr/lib/libkrb5.so)
-BROKEN=		"You must remove heimdal's /usr/lib/libkrb5.so* to build successfully with MIT-KRB"
+.    if exists(/usr/lib/libkrb5.so) || exists(/usr/bin/krb5-config)
+BROKEN=		"You must remove heimdal's /usr/bin/krb5-config and /usr/lib/libkrb5.so*, and set NO_KERBEROS=true in /etc/make.conf to build successfully with MIT-KRB"
 .    endif
-WITH_KRB5=	yes
-KRB5_HOME?=	${LOCALBASE}
-KRB5CONF=	${KRB5_HOME}/bin/krb5-config
+# Allow defining a home built MIT Kerberos by setting KRB5_HOME
+.    if defined(KRB5_HOME) && exists(${KRB5_HOME}/lib/libgssapi_krb5.a) && exists(${KRB5_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
 LIB_DEPENDS+=	krb5.3:${PORTSDIR}/security/krb5
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(WITH_HEIMDAL_KRB5)
-WITH_KRB5=	yes
-# Base heimdal in /usr will not link properly with postgresql, we must
-# use the port. See
+# Allow defining a home built Heimdal Kerberos by setting HEIMDAL_HOME
+.    if defined(HEIMDAL_HOME) && exists(${HEIMDAL_HOME}/lib/libgssapi.a) && exists(${HEIMDAL_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
+# Postgresql apps will not link properly when libpq is linked with base heimdal in /usr,
+# so we always use the heimdal port. See
 # http://lists.freebsd.org/pipermail/freebsd-stable/2005-October/018809.html
-LIB_DEPENDS+=	krb5:${PORTSDIR}/security/heimdal
-KRB5CONF=	${LOCALBASE}/bin/krb5-config
-.  endif
-
-.  if defined(WITH_KRB5)
-CONFIGURE_ARGS+=	--with-krb5
-LIBS=		`${KRB5CONF} --libs krb5`
-CONFIGURE_ENV+=	LIBS="${LIBS}"
+LIB_DEPENDS+=	krb5.20:${PORTSDIR}/security/heimdal
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(SERVER_ONLY) && defined(WITH_TESTS)