In a shell connected to subscriber edition 2.3.2 the following succeeds authentication but grants no privileges. The code is targeting the wrong userSource as a default. It should target $external, but currently targets $sasl.

var mongo = db.getMongo();
mongo.saslAuthenticate({mechanism: "GSSAPI", user: "user@DOMAIN.COM"});

The following works, but shouldn't be required.

var mongo = db.getMongo();
mongo.saslAuthenticate({mechanism: "GSSAPI", user: "user@DOMAIN.COM", userSource: "$external"});