As described in
SERVER-19191 there is a bug in on the server that makes it impossible to do a mongodump/restore with --oplogReplay with the restore role. It is hard to fix so we are punting for 3.2.
We should document the following workaround in the mongorestore docs.
The only way to do a mongorestor with --oplogReplay on a system with access control enabled is to grant the __system role to the user restoring the data.