Let postgresql (libpq.so) only link with the Kerberos implementations

installed from ports. The base heimdal distribution installs libraries
that have no depenency information. While this is quite correct, it
means that each library that links with libpq.so must also know if
libpq.so is linked with libkrb.so et al. Problem is, there's no good
way to get this information (pg_config has a --libs option starting at
version 8.1) and all ports using postgresql must be changed to make it
possible to link with a libpq.so that was configured to use the
Kerberos implementation installed in /usr by default. Hence, we
require one of the ports (heimdal or krb5) if postgresql is to be
linked with Kerberos. At least for now, until we can fix this in some
better way.

Also, if MIT Kerberos (security/krb5) is installed, users should
ideally remove the base heimdal installation so linkers will not pick
it up in preference to the krb5 libs (base heimdal has higher version
numbers than krb5 port).

PR: 80869, 88098, 85178

10 files changed, 170 insertions, 162 deletions

diff --git a/databases/postgresql73-server/Makefile b/databases/postgresql73-server/Makefile
index 84270b7b2e0..f3e7d223796 100644
--- a/databases/postgresql73-server/Makefile
+++ b/databases/postgresql73-server/Makefile
@@ -116,30 +116,31 @@ INSTALL_TARGET=	install-strip
 .  endif
 
 .  if defined(WITH_MIT_KRB5)
-WITH_KRB5=	yes
-KRB5_HOME?=	${LOCALBASE}
-KRB5CONF=	${KRB5_HOME}/bin/krb5-config
+.    if exists(/usr/lib/libkrb5.so) || exists(/usr/bin/krb5-config)
+BROKEN=		"You must remove heimdal's /usr/bin/krb5-config and /usr/lib/libkrb5.so*, and set NO_KERBEROS=true in /etc/make.conf to build successfully with MIT-KRB"
+.    endif
+# Allow defining a home built MIT Kerberos by setting KRB5_HOME
+.    if defined(KRB5_HOME) && exists(${KRB5_HOME}/lib/libgssapi_krb5.a) && exists(${KRB5_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5=${KRB5_HOME}
+.    else
 LIB_DEPENDS+=	krb5.3:${PORTSDIR}/security/krb5
+CONFIGURE_ARGS+=--with-krb5=${LOCALBASE}
+.    endif
 .  endif
 
 .  if defined(WITH_HEIMDAL_KRB5)
-WITH_KRB5=	yes
-.    if defined(HEIMDAL_HOME) && exists(${HEIMDAL_HOME}/lib/libgssapi.a)
-KRB5CONF=	${HEIMDAL_HOME}/bin/krb5-config
-.    elif ( ${OSVERSION} > 500105 ) && exists(${DESTDIR}/usr/lib/libkrb5.a)
-KRB5CONF=	${DESTDIR}/usr/bin/krb5-config
+# Allow defining a home built Heimdal Kerberos by setting HEIMDAL_HOME
+.    if defined(HEIMDAL_HOME) && exists(${HEIMDAL_HOME}/lib/libgssapi.a) && exists(${HEIMDAL_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5=${HEIMDAL_HOME}
 .    else
-LIB_DEPENDS+=	krb5:${PORTSDIR}/security/heimdal
-KRB5CONF=	${LOCALBASE}/bin/krb5-config
+# Postgresql apps will not link properly when libpq is linked with base heimdal in /usr,
+# so we always use the heimdal port. See
+# http://lists.freebsd.org/pipermail/freebsd-stable/2005-October/018809.html
+LIB_DEPENDS+=	krb5.20:${PORTSDIR}/security/heimdal
+CONFIGURE_ARGS+=--with-krb5=${LOCALBASE}
 .    endif
 .  endif
 
-.  if defined(WITH_KRB5)
-CONFIGURE_ARGS+=	--with-krb5="`${KRB5CONF} --prefix krb5`"
-LDFLAGS+=	`${KRB5CONF} --libs krb5`
-CONFIGURE_ENV+=	LDFLAGS="${LDFLAGS}"
-.  endif
-
 .  if defined(SERVER_ONLY) && defined(WITH_TESTS)
 DISTFILES+=	postgresql-test-${PORTVERSION}${EXTRACT_SUFX}
 EXTRA_PATCHES=	${FILESDIR}/regresspatch-src-test-regress-pgregress-sh
diff --git a/databases/postgresql74-server/Makefile b/databases/postgresql74-server/Makefile
index 78a778064fd..afbf6b78ba2 100644
--- a/databases/postgresql74-server/Makefile
+++ b/databases/postgresql74-server/Makefile
@@ -116,30 +116,31 @@ INSTALL_TARGET=	install-strip
 .  endif
 
 .  if defined(WITH_MIT_KRB5)
-WITH_KRB5=	yes
-KRB5_HOME?=	${LOCALBASE}
-KRB5CONF=	${KRB5_HOME}/bin/krb5-config
+.    if exists(/usr/lib/libkrb5.so) || exists(/usr/bin/krb5-config)
+BROKEN=		"You must remove heimdal's /usr/bin/krb5-config and /usr/lib/libkrb5.so*, and set NO_KERBEROS=true in /etc/make.conf to build successfully with MIT-KRB"
+.    endif
+# Allow defining a home built MIT Kerberos by setting KRB5_HOME
+.    if defined(KRB5_HOME) && exists(${KRB5_HOME}/lib/libgssapi_krb5.a) && exists(${KRB5_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5=${KRB5_HOME}
+.    else
 LIB_DEPENDS+=	krb5.3:${PORTSDIR}/security/krb5
+CONFIGURE_ARGS+=--with-krb5=${LOCALBASE}
+.    endif
 .  endif
 
 .  if defined(WITH_HEIMDAL_KRB5)
-WITH_KRB5=	yes
-.    if defined(HEIMDAL_HOME) && exists(${HEIMDAL_HOME}/lib/libgssapi.a)
-KRB5CONF=	${HEIMDAL_HOME}/bin/krb5-config
-.    elif ( ${OSVERSION} > 500105 ) && exists(${DESTDIR}/usr/lib/libkrb5.a)
-KRB5CONF=	${DESTDIR}/usr/bin/krb5-config
+# Allow defining a home built Heimdal Kerberos by setting HEIMDAL_HOME
+.    if defined(HEIMDAL_HOME) && exists(${HEIMDAL_HOME}/lib/libgssapi.a) && exists(${HEIMDAL_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5=${HEIMDAL_HOME}
 .    else
-LIB_DEPENDS+=	krb5:${PORTSDIR}/security/heimdal
-KRB5CONF=	${LOCALBASE}/bin/krb5-config
+# Postgresql apps will not link properly when libpq is linked with base heimdal in /usr,
+# so we always use the heimdal port. See
+# http://lists.freebsd.org/pipermail/freebsd-stable/2005-October/018809.html
+LIB_DEPENDS+=	krb5.20:${PORTSDIR}/security/heimdal
+CONFIGURE_ARGS+=--with-krb5=${LOCALBASE}
 .    endif
 .  endif
 
-.  if defined(WITH_KRB5)
-CONFIGURE_ARGS+=	--with-krb5="`${KRB5CONF} --prefix krb5`"
-LDFLAGS+=	`${KRB5CONF} --libs krb5`
-CONFIGURE_ENV+=	LDFLAGS="${LDFLAGS}"
-.  endif
-
 .  if defined(SERVER_ONLY) && defined(WITH_TESTS)
 DISTFILES+=	postgresql-test-${PORTVERSION}${EXTRACT_SUFX}
 EXTRA_PATCHES=	${FILESDIR}/regresspatch-src-test-regress-pgregress-sh
diff --git a/databases/postgresql80-server/Makefile b/databases/postgresql80-server/Makefile
index adb368c7120..1eb38d45f43 100644
--- a/databases/postgresql80-server/Makefile
+++ b/databases/postgresql80-server/Makefile
@@ -150,30 +150,29 @@ INSTALL_TARGET=	install-strip
 .  endif
 
 .  if defined(WITH_MIT_KRB5)
-WITH_KRB5=	yes
-KRB5_HOME?=	${LOCALBASE}
-KRB5CONF=	${KRB5_HOME}/bin/krb5-config
+.    if exists(/usr/lib/libkrb5.so) || exists(/usr/bin/krb5-config)
+BROKEN=		"You must remove heimdal's /usr/bin/krb5-config and /usr/lib/libkrb5.so*, and set NO_KERBEROS=true in /etc/make.conf to build successfully with MIT-KRB"
+.    endif
+# Allow defining a home built MIT Kerberos by setting KRB5_HOME
+.    if defined(KRB5_HOME) && exists(${KRB5_HOME}/lib/libgssapi_krb5.a) && exists(${KRB5_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
 LIB_DEPENDS+=	krb5.3:${PORTSDIR}/security/krb5
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(WITH_HEIMDAL_KRB5)
-WITH_KRB5=	yes
-.    if defined(HEIMDAL_HOME) && exists(${HEIMDAL_HOME}/lib/libgssapi.a)
-KRB5CONF=	${HEIMDAL_HOME}/bin/krb5-config
-.    elif ( defined(MAKE_KERBEROS5) || ${OSVERSION} > 500105 ) && exists(${DESTDIR}/usr/lib/libkrb5.a)
-KRB5CONF=	${DESTDIR}/usr/bin/krb5-config
+# Allow defining a home built Heimdal Kerberos by setting HEIMDAL_HOME
+.    if defined(HEIMDAL_HOME) && exists(${HEIMDAL_HOME}/lib/libgssapi.a) && exists(${HEIMDAL_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
 .    else
-LIB_DEPENDS+=	krb5:${PORTSDIR}/security/heimdal
-KRB5CONF=	${LOCALBASE}/bin/krb5-config
-.    endif
-.  endif
-
-.  if defined(WITH_KRB5)
+# Postgresql apps will not link properly when libpq is linked with base heimdal in /usr,
+# so we always use the heimdal port. See
+# http://lists.freebsd.org/pipermail/freebsd-stable/2005-October/018809.html
+LIB_DEPENDS+=	krb5.20:${PORTSDIR}/security/heimdal
 CONFIGURE_ARGS+=--with-krb5
-LIBS+=		`${KRB5CONF} --libs krb5`
-CONFIGURE_ENV+=	LIBS="${LIBS}" LDFLAGS="${LIBS}"
-.  else
-CONFIGURE_ARGS+=--without-krb5
+.    endif
 .  endif
 
 .  if defined(SERVER_ONLY) && defined(WITH_TESTS)
diff --git a/databases/postgresql81-server/Makefile b/databases/postgresql81-server/Makefile
index a8c6aad8b86..171f826d37a 100644
--- a/databases/postgresql81-server/Makefile
+++ b/databases/postgresql81-server/Makefile
@@ -150,28 +150,29 @@ INSTALL_TARGET=	install-strip
 .  endif
 
 .  if defined(WITH_MIT_KRB5)
-.    if exists(/usr/lib/libkrb5.so)
-BROKEN=		"You must remove heimdal's /usr/lib/libkrb5.so* to build successfully with MIT-KRB"
+.    if exists(/usr/lib/libkrb5.so) || exists(/usr/bin/krb5-config)
+BROKEN=		"You must remove heimdal's /usr/bin/krb5-config and /usr/lib/libkrb5.so*, and set NO_KERBEROS=true in /etc/make.conf to build successfully with MIT-KRB"
 .    endif
-WITH_KRB5=	yes
-KRB5_HOME?=	${LOCALBASE}
-KRB5CONF=	${KRB5_HOME}/bin/krb5-config
+# Allow defining a home built MIT Kerberos by setting KRB5_HOME
+.    if defined(KRB5_HOME) && exists(${KRB5_HOME}/lib/libgssapi_krb5.a) && exists(${KRB5_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
 LIB_DEPENDS+=	krb5.3:${PORTSDIR}/security/krb5
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(WITH_HEIMDAL_KRB5)
-WITH_KRB5=	yes
-# Base heimdal in /usr will not link properly with postgresql, we must
-# use the port. See
+# Allow defining a home built Heimdal Kerberos by setting HEIMDAL_HOME
+.    if defined(HEIMDAL_HOME) && exists(${HEIMDAL_HOME}/lib/libgssapi.a) && exists(${HEIMDAL_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
+# Postgresql apps will not link properly when libpq is linked with base heimdal in /usr,
+# so we always use the heimdal port. See
 # http://lists.freebsd.org/pipermail/freebsd-stable/2005-October/018809.html
-LIB_DEPENDS+=	krb5:${PORTSDIR}/security/heimdal
-KRB5CONF=	${LOCALBASE}/bin/krb5-config
-.  endif
-
-.  if defined(WITH_KRB5)
-CONFIGURE_ARGS+=	--with-krb5
-LIBS=		`${KRB5CONF} --libs krb5`
-CONFIGURE_ENV+=	LIBS="${LIBS}"
+LIB_DEPENDS+=	krb5.20:${PORTSDIR}/security/heimdal
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(SERVER_ONLY) && defined(WITH_TESTS)
diff --git a/databases/postgresql82-server/Makefile b/databases/postgresql82-server/Makefile
index a8c6aad8b86..171f826d37a 100644
--- a/databases/postgresql82-server/Makefile
+++ b/databases/postgresql82-server/Makefile
@@ -150,28 +150,29 @@ INSTALL_TARGET=	install-strip
 .  endif
 
 .  if defined(WITH_MIT_KRB5)
-.    if exists(/usr/lib/libkrb5.so)
-BROKEN=		"You must remove heimdal's /usr/lib/libkrb5.so* to build successfully with MIT-KRB"
+.    if exists(/usr/lib/libkrb5.so) || exists(/usr/bin/krb5-config)
+BROKEN=		"You must remove heimdal's /usr/bin/krb5-config and /usr/lib/libkrb5.so*, and set NO_KERBEROS=true in /etc/make.conf to build successfully with MIT-KRB"
 .    endif
-WITH_KRB5=	yes
-KRB5_HOME?=	${LOCALBASE}
-KRB5CONF=	${KRB5_HOME}/bin/krb5-config
+# Allow defining a home built MIT Kerberos by setting KRB5_HOME
+.    if defined(KRB5_HOME) && exists(${KRB5_HOME}/lib/libgssapi_krb5.a) && exists(${KRB5_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
 LIB_DEPENDS+=	krb5.3:${PORTSDIR}/security/krb5
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(WITH_HEIMDAL_KRB5)
-WITH_KRB5=	yes
-# Base heimdal in /usr will not link properly with postgresql, we must
-# use the port. See
+# Allow defining a home built Heimdal Kerberos by setting HEIMDAL_HOME
+.    if defined(HEIMDAL_HOME) && exists(${HEIMDAL_HOME}/lib/libgssapi.a) && exists(${HEIMDAL_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
+# Postgresql apps will not link properly when libpq is linked with base heimdal in /usr,
+# so we always use the heimdal port. See
 # http://lists.freebsd.org/pipermail/freebsd-stable/2005-October/018809.html
-LIB_DEPENDS+=	krb5:${PORTSDIR}/security/heimdal
-KRB5CONF=	${LOCALBASE}/bin/krb5-config
-.  endif
-
-.  if defined(WITH_KRB5)
-CONFIGURE_ARGS+=	--with-krb5
-LIBS=		`${KRB5CONF} --libs krb5`
-CONFIGURE_ENV+=	LIBS="${LIBS}"
+LIB_DEPENDS+=	krb5.20:${PORTSDIR}/security/heimdal
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(SERVER_ONLY) && defined(WITH_TESTS)
diff --git a/databases/postgresql83-server/Makefile b/databases/postgresql83-server/Makefile
index a8c6aad8b86..171f826d37a 100644
--- a/databases/postgresql83-server/Makefile
+++ b/databases/postgresql83-server/Makefile
@@ -150,28 +150,29 @@ INSTALL_TARGET=	install-strip
 .  endif
 
 .  if defined(WITH_MIT_KRB5)
-.    if exists(/usr/lib/libkrb5.so)
-BROKEN=		"You must remove heimdal's /usr/lib/libkrb5.so* to build successfully with MIT-KRB"
+.    if exists(/usr/lib/libkrb5.so) || exists(/usr/bin/krb5-config)
+BROKEN=		"You must remove heimdal's /usr/bin/krb5-config and /usr/lib/libkrb5.so*, and set NO_KERBEROS=true in /etc/make.conf to build successfully with MIT-KRB"
 .    endif
-WITH_KRB5=	yes
-KRB5_HOME?=	${LOCALBASE}
-KRB5CONF=	${KRB5_HOME}/bin/krb5-config
+# Allow defining a home built MIT Kerberos by setting KRB5_HOME
+.    if defined(KRB5_HOME) && exists(${KRB5_HOME}/lib/libgssapi_krb5.a) && exists(${KRB5_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
 LIB_DEPENDS+=	krb5.3:${PORTSDIR}/security/krb5
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(WITH_HEIMDAL_KRB5)
-WITH_KRB5=	yes
-# Base heimdal in /usr will not link properly with postgresql, we must
-# use the port. See
+# Allow defining a home built Heimdal Kerberos by setting HEIMDAL_HOME
+.    if defined(HEIMDAL_HOME) && exists(${HEIMDAL_HOME}/lib/libgssapi.a) && exists(${HEIMDAL_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
+# Postgresql apps will not link properly when libpq is linked with base heimdal in /usr,
+# so we always use the heimdal port. See
 # http://lists.freebsd.org/pipermail/freebsd-stable/2005-October/018809.html
-LIB_DEPENDS+=	krb5:${PORTSDIR}/security/heimdal
-KRB5CONF=	${LOCALBASE}/bin/krb5-config
-.  endif
-
-.  if defined(WITH_KRB5)
-CONFIGURE_ARGS+=	--with-krb5
-LIBS=		`${KRB5CONF} --libs krb5`
-CONFIGURE_ENV+=	LIBS="${LIBS}"
+LIB_DEPENDS+=	krb5.20:${PORTSDIR}/security/heimdal
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(SERVER_ONLY) && defined(WITH_TESTS)
diff --git a/databases/postgresql84-server/Makefile b/databases/postgresql84-server/Makefile
index a8c6aad8b86..171f826d37a 100644
--- a/databases/postgresql84-server/Makefile
+++ b/databases/postgresql84-server/Makefile
@@ -150,28 +150,29 @@ INSTALL_TARGET=	install-strip
 .  endif
 
 .  if defined(WITH_MIT_KRB5)
-.    if exists(/usr/lib/libkrb5.so)
-BROKEN=		"You must remove heimdal's /usr/lib/libkrb5.so* to build successfully with MIT-KRB"
+.    if exists(/usr/lib/libkrb5.so) || exists(/usr/bin/krb5-config)
+BROKEN=		"You must remove heimdal's /usr/bin/krb5-config and /usr/lib/libkrb5.so*, and set NO_KERBEROS=true in /etc/make.conf to build successfully with MIT-KRB"
 .    endif
-WITH_KRB5=	yes
-KRB5_HOME?=	${LOCALBASE}
-KRB5CONF=	${KRB5_HOME}/bin/krb5-config
+# Allow defining a home built MIT Kerberos by setting KRB5_HOME
+.    if defined(KRB5_HOME) && exists(${KRB5_HOME}/lib/libgssapi_krb5.a) && exists(${KRB5_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
 LIB_DEPENDS+=	krb5.3:${PORTSDIR}/security/krb5
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(WITH_HEIMDAL_KRB5)
-WITH_KRB5=	yes
-# Base heimdal in /usr will not link properly with postgresql, we must
-# use the port. See
+# Allow defining a home built Heimdal Kerberos by setting HEIMDAL_HOME
+.    if defined(HEIMDAL_HOME) && exists(${HEIMDAL_HOME}/lib/libgssapi.a) && exists(${HEIMDAL_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
+# Postgresql apps will not link properly when libpq is linked with base heimdal in /usr,
+# so we always use the heimdal port. See
 # http://lists.freebsd.org/pipermail/freebsd-stable/2005-October/018809.html
-LIB_DEPENDS+=	krb5:${PORTSDIR}/security/heimdal
-KRB5CONF=	${LOCALBASE}/bin/krb5-config
-.  endif
-
-.  if defined(WITH_KRB5)
-CONFIGURE_ARGS+=	--with-krb5
-LIBS=		`${KRB5CONF} --libs krb5`
-CONFIGURE_ENV+=	LIBS="${LIBS}"
+LIB_DEPENDS+=	krb5.20:${PORTSDIR}/security/heimdal
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(SERVER_ONLY) && defined(WITH_TESTS)
diff --git a/databases/postgresql90-server/Makefile b/databases/postgresql90-server/Makefile
index a8c6aad8b86..171f826d37a 100644
--- a/databases/postgresql90-server/Makefile
+++ b/databases/postgresql90-server/Makefile
@@ -150,28 +150,29 @@ INSTALL_TARGET=	install-strip
 .  endif
 
 .  if defined(WITH_MIT_KRB5)
-.    if exists(/usr/lib/libkrb5.so)
-BROKEN=		"You must remove heimdal's /usr/lib/libkrb5.so* to build successfully with MIT-KRB"
+.    if exists(/usr/lib/libkrb5.so) || exists(/usr/bin/krb5-config)
+BROKEN=		"You must remove heimdal's /usr/bin/krb5-config and /usr/lib/libkrb5.so*, and set NO_KERBEROS=true in /etc/make.conf to build successfully with MIT-KRB"
 .    endif
-WITH_KRB5=	yes
-KRB5_HOME?=	${LOCALBASE}
-KRB5CONF=	${KRB5_HOME}/bin/krb5-config
+# Allow defining a home built MIT Kerberos by setting KRB5_HOME
+.    if defined(KRB5_HOME) && exists(${KRB5_HOME}/lib/libgssapi_krb5.a) && exists(${KRB5_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
 LIB_DEPENDS+=	krb5.3:${PORTSDIR}/security/krb5
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(WITH_HEIMDAL_KRB5)
-WITH_KRB5=	yes
-# Base heimdal in /usr will not link properly with postgresql, we must
-# use the port. See
+# Allow defining a home built Heimdal Kerberos by setting HEIMDAL_HOME
+.    if defined(HEIMDAL_HOME) && exists(${HEIMDAL_HOME}/lib/libgssapi.a) && exists(${HEIMDAL_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
+# Postgresql apps will not link properly when libpq is linked with base heimdal in /usr,
+# so we always use the heimdal port. See
 # http://lists.freebsd.org/pipermail/freebsd-stable/2005-October/018809.html
-LIB_DEPENDS+=	krb5:${PORTSDIR}/security/heimdal
-KRB5CONF=	${LOCALBASE}/bin/krb5-config
-.  endif
-
-.  if defined(WITH_KRB5)
-CONFIGURE_ARGS+=	--with-krb5
-LIBS=		`${KRB5CONF} --libs krb5`
-CONFIGURE_ENV+=	LIBS="${LIBS}"
+LIB_DEPENDS+=	krb5.20:${PORTSDIR}/security/heimdal
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(SERVER_ONLY) && defined(WITH_TESTS)
diff --git a/databases/postgresql91-server/Makefile b/databases/postgresql91-server/Makefile
index a8c6aad8b86..171f826d37a 100644
--- a/databases/postgresql91-server/Makefile
+++ b/databases/postgresql91-server/Makefile
@@ -150,28 +150,29 @@ INSTALL_TARGET=	install-strip
 .  endif
 
 .  if defined(WITH_MIT_KRB5)
-.    if exists(/usr/lib/libkrb5.so)
-BROKEN=		"You must remove heimdal's /usr/lib/libkrb5.so* to build successfully with MIT-KRB"
+.    if exists(/usr/lib/libkrb5.so) || exists(/usr/bin/krb5-config)
+BROKEN=		"You must remove heimdal's /usr/bin/krb5-config and /usr/lib/libkrb5.so*, and set NO_KERBEROS=true in /etc/make.conf to build successfully with MIT-KRB"
 .    endif
-WITH_KRB5=	yes
-KRB5_HOME?=	${LOCALBASE}
-KRB5CONF=	${KRB5_HOME}/bin/krb5-config
+# Allow defining a home built MIT Kerberos by setting KRB5_HOME
+.    if defined(KRB5_HOME) && exists(${KRB5_HOME}/lib/libgssapi_krb5.a) && exists(${KRB5_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
 LIB_DEPENDS+=	krb5.3:${PORTSDIR}/security/krb5
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(WITH_HEIMDAL_KRB5)
-WITH_KRB5=	yes
-# Base heimdal in /usr will not link properly with postgresql, we must
-# use the port. See
+# Allow defining a home built Heimdal Kerberos by setting HEIMDAL_HOME
+.    if defined(HEIMDAL_HOME) && exists(${HEIMDAL_HOME}/lib/libgssapi.a) && exists(${HEIMDAL_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
+# Postgresql apps will not link properly when libpq is linked with base heimdal in /usr,
+# so we always use the heimdal port. See
 # http://lists.freebsd.org/pipermail/freebsd-stable/2005-October/018809.html
-LIB_DEPENDS+=	krb5:${PORTSDIR}/security/heimdal
-KRB5CONF=	${LOCALBASE}/bin/krb5-config
-.  endif
-
-.  if defined(WITH_KRB5)
-CONFIGURE_ARGS+=	--with-krb5
-LIBS=		`${KRB5CONF} --libs krb5`
-CONFIGURE_ENV+=	LIBS="${LIBS}"
+LIB_DEPENDS+=	krb5.20:${PORTSDIR}/security/heimdal
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(SERVER_ONLY) && defined(WITH_TESTS)
diff --git a/databases/postgresql92-server/Makefile b/databases/postgresql92-server/Makefile
index a8c6aad8b86..171f826d37a 100644
--- a/databases/postgresql92-server/Makefile
+++ b/databases/postgresql92-server/Makefile
@@ -150,28 +150,29 @@ INSTALL_TARGET=	install-strip
 .  endif
 
 .  if defined(WITH_MIT_KRB5)
-.    if exists(/usr/lib/libkrb5.so)
-BROKEN=		"You must remove heimdal's /usr/lib/libkrb5.so* to build successfully with MIT-KRB"
+.    if exists(/usr/lib/libkrb5.so) || exists(/usr/bin/krb5-config)
+BROKEN=		"You must remove heimdal's /usr/bin/krb5-config and /usr/lib/libkrb5.so*, and set NO_KERBEROS=true in /etc/make.conf to build successfully with MIT-KRB"
 .    endif
-WITH_KRB5=	yes
-KRB5_HOME?=	${LOCALBASE}
-KRB5CONF=	${KRB5_HOME}/bin/krb5-config
+# Allow defining a home built MIT Kerberos by setting KRB5_HOME
+.    if defined(KRB5_HOME) && exists(${KRB5_HOME}/lib/libgssapi_krb5.a) && exists(${KRB5_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
 LIB_DEPENDS+=	krb5.3:${PORTSDIR}/security/krb5
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(WITH_HEIMDAL_KRB5)
-WITH_KRB5=	yes
-# Base heimdal in /usr will not link properly with postgresql, we must
-# use the port. See
+# Allow defining a home built Heimdal Kerberos by setting HEIMDAL_HOME
+.    if defined(HEIMDAL_HOME) && exists(${HEIMDAL_HOME}/lib/libgssapi.a) && exists(${HEIMDAL_HOME}/bin/krb5-config)
+CONFIGURE_ARGS+=--with-krb5
+.    else
+# Postgresql apps will not link properly when libpq is linked with base heimdal in /usr,
+# so we always use the heimdal port. See
 # http://lists.freebsd.org/pipermail/freebsd-stable/2005-October/018809.html
-LIB_DEPENDS+=	krb5:${PORTSDIR}/security/heimdal
-KRB5CONF=	${LOCALBASE}/bin/krb5-config
-.  endif
-
-.  if defined(WITH_KRB5)
-CONFIGURE_ARGS+=	--with-krb5
-LIBS=		`${KRB5CONF} --libs krb5`
-CONFIGURE_ENV+=	LIBS="${LIBS}"
+LIB_DEPENDS+=	krb5.20:${PORTSDIR}/security/heimdal
+CONFIGURE_ARGS+=--with-krb5
+.    endif
 .  endif
 
 .  if defined(SERVER_ONLY) && defined(WITH_TESTS)