I cannot do anything on replSet when auth is enabled
When I created admin users against mongos, I also created admin users for replication Set. Now I can administrate shards, config server, and mongos now.

Different shards can have different users in their admin databases. If keyfile is uique, new shard (running with auth and keyfile enabled) can be added to the running cluster.