-\fISu\fP requests the password for \fIlogin\fP (or for ``root'', if no
-login is provided), and switches to that user and group ID. A shell is
-then invoked.
+\fISu\fP requests the Kerberos password
+for \fIlogin\fP (or for ``\fIlogin\fP.root'', if no
+login is provided), and switches to that user and group ID after
+issueing a Kerberos ticket granting ticket.
+A shell is then invoked .
+\fISu\fP will resort to the local password file to find the password
+for \fIlogin\fP if there is a Kerberos error or if the \fB-n\fP flag is given.