We found that some of the Error numbers do not match the error codes in the error message body, for example:

Error: 18

{ ok: 0.0, errmsg: "X.509 authentication must always use the $external database.", code: 17 }

Error: 18

{ ok: 0.0, errmsg: "User not found", code: 11 }

Should they be the same or it is expected behavior?

You can observe the above output by running the test case found here:

https://github.com/10gen/QA/blob/master/QA-335/auth_error_code_X509.js

You can uncomment line 25 to see a detailed error message.