title: A MongoDB "userAdminAnyDatabase" user cannot admin users in "any database". Why?
body: <p>This is a <code>userAdmin</code> vs. <code>userAdminAnyDatabase</code> question.</p>
  
  <p>In the <code>system.users</code> I have the following users (password <code>1234</code> for both):</p>
  
  <pre><code>&gt; db.system.users.find()
  { "_id" : ObjectId("52a976cb7851682aa44d6d4d"), "user" : "admin_one", "pwd" : "884f516cf308a4c6a75bbc5a0a00807b", "roles" : [  "userAdmin",  "dbAdmin" ] }
  { "_id" : ObjectId("52a97c697851682aa44d6d4f"), "user" : "admin_two", "pwd" : "26e7bb644e5919461cd6ba7403dc6906", "roles" : [  "userAdminAnyDatabase",  "dbAdminAnyDatabase" ] }
  </code></pre>
  
  <p>Connecting with a wrong user:</p>
  
  <pre><code>$ mongo mono -u admin -p 1234
  connecting to: mono
  Thu Dec 12 10:09:00.733 Error: 18 { code: 18, ok: 0.0, errmsg: "auth fails" } at src/mongo/shell/db.js:228
  </code></pre>
  
  <p>which is OK.</p>
  
  <p>Connecting with the db admin:</p>
  
  <pre><code>$ mongo mono -u admin_one -p 1234
  connecting to: mono
  &gt; db.system.users.find()
  { "_id" : ObjectId("52a976cb7851682aa44d6d4d"), "user" : "admin_one", "pwd" : "884f516cf308a4c6a75bbc5a0a00807b", "roles" : [  "userAdmin",  "dbAdmin" ] }
  { "_id" : ObjectId("52a97c697851682aa44d6d4f"), "user" : "admin_two", "pwd" : "26e7bb644e5919461cd6ba7403dc6906", "roles" : [  "userAdminAnyDatabase",  "dbAdminAnyDatabase" ] }
  </code></pre>
  
  <p>which is also OK.</p>
  
  <p>Now, connecting with the "AnyDatabase" admin I get an error:</p>
  
  <pre><code>$ mongo mono -u admin_two -p 1234
  connecting to: mono
  &gt; db.system.users.find()
  error: { "$err" : "not authorized for query on mono.system.users", "code" : 16550 }
  </code></pre>
  
  <p>Why?</p>