upstream: make a AuthorizedPrincipalsCommand with no specified

arguments do what it is documented to do: supply the target username as a
default argument.

Anthropic ANT-2026-YX19N77E

OpenBSD-Commit-ID: 2cce51be98e3311666b4d715beea9588cfb55848

auth2-pubkey.c

@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-pubkey.c,v 1.132 2026/10/11 20:41:20 dtucker Exp $ */
+/* $OpenBSD: auth2-pubkey.c,v 1.133 2026/10/30 09:04:01 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  * Copyright (c) 2010 Damien Miller.  All rights reserved.
@@ -499,6 +499,18 @@ match_principals_command(struct passwd *user_pw, const struct sshkey *key,
 		free(av[i]);
 		av[i] = tmp;
 	}
+
+	/*
+	 * If AuthorizedPrincipalsCommand was specified without arguments
+	 * then pass the target username as a single argument, as is done
+	 * for AuthorizedKeysCommand.
+	 */
+	if (ac == 1) {
+		av = xreallocarray(av, ac + 2, sizeof(*av));
+		av[ac++] = xstrdup(user_pw->pw_name);
+		av[ac] = NULL;
+	}
+
 	/* Prepare a printable command for logs, etc. */
 	command = argv_assemble(ac, av);