While testing a program that instantiates a MongoClient instance for the user a came across the following:

1) the MongoClient does not perform any authentication when being created
2) authentication occurs when a command is being executed on the MongoClient

I want to check if provided credentials are valid before returning the MongoClient to the user, so I began testing to see what command would throw an exception if the credentials were incorrect.

During one of my tests I observed the following:
1) a MongoClient that was created with invalid credentials was capable of connecting to our db, listing out the collections, and listing out the documents within those collections.

this MongoClient is being instantiated with a MongoClientURI which contains the username and password. The users are authenticated using LDAP.