The "Add Users After Enabling Access Control" section of /manual/tutorial/enable-authentication/ describes how to create the first user after creating a new node that has auth enabled.

I think the list of steps should include a new one between the current steps 2 and 3, pointing out if the node has the replSet arg (i.e. it is the first node of new replica set being created) that rs.initiate() will need to be run as the first step, before db.createUser(). If it isn't then no writes will be permitted (the node is not yet a primary), so the db.createUser() command will be refused for that reason.

Without that caveat users may think the error they see when they run db.createUser() is something they did wrong in regards to options they set or how well they followed our instructions.