Do root's supplementary groups behave differently than regular account ones for NFS shares?

Question

OS: Linux CentOS 7, NFSv4

On one machine I exported an NFS share group-owned by the nfsgroup with 2770 privileges for group collaboration:

groupadd -g 5000 nfsgroup
chown nobody:nfsgroup /home/groupshare
chmod 2770 /home/groupshare

Then, on the other machine I add the same group and assign it to the root user. I then try to access the mounted NFS share and get a 'Permission denied' error:

groupadd -g 5000 nfsgroup
usermod -a -G nfsgroup root
ls -l /mnt/groupshare       # Permission denied!

Note: For this I tried to re-login as root and even reboot the machine, the result is the same: Permission denied.

I then do the same thing for the regular account (named user) and have no access problems

usermod -a -G nfsgroup user
su - user
ls -l /mnt/groupshare      # Works as expected, no permission errors

The only way I can access the share under the root is by changing the effective group (despite supplementary nfsgroup is there):

su - root
newgrp nfsgroup
ls -l /mnt/groupshare     # No permission errors

I find this behavior inconsistent and weird. Can someone please shed a light on why it behaves this way?

One piece of information, that maybe somehow relevant is as follows. Both the id (under user account) and id user return the same output, in particular groups=1000(user),5000(nfsgroup), while the id (under root account) produces groups=0(root) and id root outputs, as expected, groups=0(root),5000(nfsgroup).

Answer 1

I think I found what caused the problem. When NFS client accesses an NFS share, the server checks UID and GID of the accessing user. And by default NFS server comes with root_squash option enabled, that assigns NFS client accessing the share as root the UID/GID of nfsnobody.

After I had added the no_root_squash option to the export in /etc/exports file the problem disappeared.

Apparently when NFS server 'squashes' root's UID/GID it disregards the supplementary groups altogether (seems wrong to me, but probably the NFSv4 standard thinks differently).