NFSv4 uses idmapd with a defined "domain," unlike direct uid/gid mapping of earlier versions. When the idmapd daemons on either side cannot agree on the domain

NFSv4 uses idmapd with a defined "domain," unlike direct uid/gid mapping of earlier versions. When the idmapd daemons on either side cannot agree on the domain, all users will be "squashed" to the default NFS user. Root is always squashed, unless nosquash is specified in /etc/exports (which goes for earlier protocol versions as well). NFSv4 [cleartext] does not require kerberos. Kerberos can be used to encrypt the data stream between client and server, but this can also be accomplished with stunnel over TLS (google "nfs encryption" for details).