http://docs.mongodb.org/manual/tutorial/enable-authentication-in-sharded-cluster/

1. The current page doesn't make it clear that downtime is required when "upgrading" a sharded cluster to use auth. It seems that other users have been confused by this as well and have asked about it on mongodb user.

2. The response to this question on GG also brings up considerations the documentation does not mention. Stopping 1 config server to ensure that metadata becomes read-only before stopping shard servers and stopping the balancer to ensure that documents are not in flight should become "step 2" of the process, or get merged into the current "step 2."