The server doesn't have a consistent story as to whether * is a valid database name. _initializeUserRolesFromV1RolesArray rejects * due to its conflict with WILDCARD_RESOURCE_NAME, but NamespaceString::validDBName blacklists the * character only inside an #ifdef _WIN32 section.

In 2.4.6:

db.getSiblingDB("*").addUser({user:'x',pwd:'x',roles:['read']})
db.getSiblingDB("*").auth('x','x')

Wed Sep 18 17:28:42.103 [conn1] Privilege acquisition failed for x@* in database *: * is an invalid database name. (BadValue)