This is done by making mongorestore insert the users/roles from the dump files into temporary collections that are later merged into the real admin.system.users and admin.system.roles collections using a new command: _mergeAuthzCollections.