--- databases/postgresql16-server/Makefile	2024-11-21 20:15:39.008621000 -0500
+++ databases/postgresql16-server/Makefile	2024-11-21 20:19:16.406249000 -0500
@@ -118,18 +118,26 @@
 
 .if !defined(SLAVE_ONLY)
 OPTIONS_DEFINE+=	NLS PAM GSSAPI OPTIMIZED_CFLAGS DEBUG DOCS SSL
-KRB5_DESC=		Build with kerberos provider support
+OPTIONS_SINGLE+=	GSSAPI
+OPTIONS_SINGLE_GSSAPI=	GSSAPI_NONE GSSAPI_BASE GSSAPI_HEIMDAL GSSAPI_MIT
+OPTIONS_DEFAULT+=	GSSAPI_NONE
+GSSAPI_NONE_DESC=	Build without GSSAPI support
+GSSAPI_BASE_DESC=	Use GSSAPI from base
+GSSAPI_HEIMDAL_DESC=	Use Heimdal GSSAPI from security/heimdal
+GSSAPI_MIT_DESC=	Use MIT GSSAPI from security/krb5
 NLS_DESC=		Use internationalized messages
 PAM_DESC=		Build with PAM Support
-MIT_KRB5_DESC=		Build with MIT kerberos support
-HEIMDAL_KRB5_DESC=	Builds with Heimdal kerberos
-GSSAPI_DESC=		Build with GSSAPI support
 OPTIMIZED_CFLAGS_DESC=	Builds with compiler optimizations (-O3)
 SSL_DESC=		Build with OpenSSL support
 
 OPTIONS_DEFAULT+=	SSL
 
-GSSAPI_CONFIGURE_WITH=	gssapi
+GSSAPI_BASE_USES=	gssapi:base
+GSSAPI_MIT_USES=	gssapi:mit
+GSSAPI_HEIMDAL_USES=	gssapi:heimdal,flags
+GSSAPI_BASE_CONFIGURE_ON=	--with-gssapi
+GSSAPI_MIT_CONFIGURE_ON=	--with-gssapi
+GSSAPI_HEIMDAL_CONFIGURE_ON=	--with-gssapi
 .endif # !SLAVE_ONLY
 
 SSL_USES=		ssl
@@ -172,36 +180,7 @@
 .endif
 
 .if !defined(SLAVE_ONLY)
-
 PATCH_DIST_STRIP=-p1
-
-.if ${PORT_OPTIONS:MGSSAPI}
-.if empty(PORT_OPTIONS:MMIT_KRB5) && empty(PORT_OPTIONS:MHEIMDAL_KRB5)
-# Kerberos libraries will pull the proper GSSAPI library
-# via linker dependencies, but otherwise we must specify
-# it explicitely: ld --as-needed is used for compilation,
-# so configure's -lgssapi_krb5 won't go.
-LDFLAGS+=	-lgssapi
-LDFLAGS_SL+=	-lgssapi
-.endif
-.endif
-
-.  if ${PORT_OPTIONS:MMIT_KRB5}
-.   if defined(IGNORE_WITH_SRC_KRB5) && (exists(/usr/lib/libkrb5.so) || exists(/usr/bin/krb5-config))
-IGNORE=	requires that you remove heimdal\'s /usr/bin/krb5-config and /usr/lib/libkrb5.so*, and set NO_KERBEROS=true in /etc/src.conf to build successfully with MIT-KRB
-.   else
-CONFIGURE_ARGS+=--with-krb5
-# Allow defining a home built MIT Kerberos by setting KRB5_HOME
-.    if defined(KRB5_HOME) && exists(${KRB5_HOME}/lib/libgssapi_krb5.a) && exists(${KRB5_HOME}/bin/krb5-config)
-LIB_DEPENDS+=	libkrb5.so.3:security/krb5
-.    endif
-.   endif
-.  endif
-
-.  if ${PORT_OPTIONS:MHEIMDAL_KRB5}
-CONFIGURE_ARGS+=--with-krb5
-.  endif
-
 .endif # !SLAVE_ONLY
 
 # For testing files in FILESDIR