Not actually tried, but we should check if this works (Note that we need to add admin users in the config databases to simulate remote access in an auth environment when testing).

Suspicious code in ConfigServer::replicaSetChange:

scoped_ptr<ScopedDbConnection> conn( ScopedDbConnection::getScopedDbConnection(
                    configServer.getConnectionString().toString(), 30.0 ) );

Shouldn't this be using getInternalScopedDbConnection instead?