If you are using "root" then no need for kinit, as the krb-unix mapping handles that.
But your original question was about a specific user - for that, you'd need to kinit. And there is a krb-unix mapping for USER@DOMAIN.COM to UNIX user USER, but that doesn't require a name mapping rule, provided ONTAP can find the UNIX user named "USER" in name services.
In my lab, as root, I can chown with the restricted chown-mode set without needing to kinit:
::*> nfs show -vserver DEMO -fields chown-mode
vserver chown-mode
------- -----------------
DEMO use_export_policy
::*> export-policy rule show -vserver DEMO -policyname home -fields chown-mode
vserver policyname ruleindex chown-mode
------- ---------- --------- ----------
DEMO home 1 restricted
Here's the Kerberos mount:
[root@centos7 /]# mount -o sec=krb5 demo:/home /mnt/home
[root@centos7 /]# mount | grep home
auto.homedir on /home type autofs (rw,relatime,fd=17,pgrp=1157,timeout=50,minproto=5,maxproto=5,indirect,pipe_ino=971)
demo:/home on /mnt/home type nfs4 (rw,relatime,vers=4.1,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=krb5,clientaddr=10.193.67.225,local_lock=none,addr=10.193.67.237)
Note that when I create a new file, the owner is root. In your case, the owner is nobody, which is likely why it's failing for you... root is not root there.
[root@centos7 /]# cd /mnt/home
[root@centos7 home]# touch newfile
[root@centos7 home]# ls -la | grep newfile
-rw-r--r-- 1 root daemon 0 Jun 9 13:04 newfile
And I can chown that file as root with no issues:
[root@centos7 home]# chown prof1 newfile
[root@centos7 home]# ls -la | grep newfile
-rw-r--r-- 1 prof1 daemon 0 Jun 9 13:04 newfile
As a regular user, I can't (because of the restricted chown mode - aka, root-only-chown):
# su prof1
sh-4.2$ kinit
Password for prof1@NTAP.LOCAL:
sh-4.2$ cd ~
sh-4.2$ mkdir newdir2
sh-4.2$ ls -la | grep newdir2
drwxr-xr-x 2 prof1 ProfGroup 4096 Jun 9 13:09 newdir2
sh-4.2$ chown student1 newdir2
chown: changing ownership of ‘newdir2’: Operation not permitted
When I set the export policy to allow it, I can chown with a regular user:
::*> export-policy rule modify -vserver DEMO -policyname home -ruleindex 1 -chown-mode unrestricted
sh-4.2$ chown student1 newdir2
sh-4.2$ ls -la | grep newdir2
drwxr-xr-x 2 student1 ProfGroup 4096 Jun 9 13:09 newdir2
In a homedir setting, you can create a qtree per user and apply individual export policies to those qtrees if you want different levels of access for chown, control for different clients, etc.
You'd need to look into why root is writing files as "nobody" here; I suspect it's due to how you've set up your krb-unix name mapping or you've set "superuser" to "none" in the export-policy rule and it's getting squashed to the user set in -anon (which is 65534 by default).
