When using Secure NFS, all clients need kerberos credentials to access files on NFS.
However some application that run as a specific user may have no knowledge whatsoever of NFS and krb5. In this case admins would like to be able to transparently make them work w/o having to use custom init scripts to run things like k5start or similar wrappers to keep krb5 credentials current.

GSS-Proxy can be used in this case to init credentials on behalf of these applications instead of just using ccache from users.

One way is to use a keytab, to make configuration simple the keytab could be stored in a directory names after the application's user id. So that if app foo runs as user 'foo' with uid 123456 then gssproxy can find out automatically if there is a 'user-keytab' for the application.
On init sec context coming in from the kernel, the gssproxy may check if /path/to/special/keys/12345/krb5.keytab exist. If it does gss-proxy will acquire credentials using that keytab and then perform a gss_init_sec_context call with those creds.

Another, more advanced option is to let gssproxy use s4u2proxy with a special keytab (could be the host/ principal too) and obtain a nfs ticket on behalf of the user.