http://code.logic.net/2009/12/kerberos-and-ksu/

xksu.sh

#!/bin/sh

# Replacement for raw "ksu" in kerberized environments;
# behaves more like "su -", and retains xauth data.

if [ $# -lt 1 ]
then
    echo "Usage: `basename $0` <target user> [ <command> [ <arg> ] ... ]"
    exit 2
fi

TARGET_USER="$1"
shift

# be a basic login shell if no command is specified.
if [ -z "$*" ]
then
    TARGET_CMD='-l'
else
    TARGET_CMD="-c '$*'"
fi

# FD 4 becomes stdin
exec 4>&0

xauth list | sed -e 's/^/add /' | {
    # FD 3 becomes xauth output
    # FD 0 becomes stdin again
    # FD 4 is closed
    exec 3>&0 0>&4 4>&-

    exec /usr/bin/env -u PATH -u LD_LIBRARY_PATH \
      /usr/krb5/bin/ksu "${TARGET_USER}" -e /bin/bash -l -c "
        xauth -q <&3
        cd
        exec /usr/bin/env DISPLAY='${DISPLAY}' "'"$SHELL"'" ${TARGET_CMD} 3>&-"
}