Configure generates src/aklog/Makefile even if you don't specify --with-krb5. That's ok because the top-level Makefile doesn't try to descend into src/aklog. But you run into trouble if someone tries to do the make manually, because the correct flags won't be set. This is really user error but we could help by not generating the Makefile in the first place.