mongodump - not authenticating when using secondary

Question

I am having an issue that I cannot figure out. When I do a backup from the primary the dump works. When I do it from the secondary it always get the error "listDatabases requires authentication".

If I connect with mongo using the same user I can run this on both primary and secondary. (rs.slaveOk() needed for secondary)

db.adminCommand( { listDatabases: 1 } )

The user has these roles.

    {
        "role" : "backup",
        "db" : "admin"
    },
    {
        "role" : "userAdminAnyDatabase",
        "db" : "admin"
    },
    {
        "role" : "restore",
        "db" : "admin"
    },
    {
        "role" : "root",
        "db" : "admin"
    }

I can see the user has these roles on both the primary and secondary.

However this command fails when run on secondary:

mongodump --archive=dump.gz --gzip --oplog --port xxxxx --username xx --password xx --authenticationDatabase=admin  
Failed: error creating intents to dump: error getting database names: (Unauthorized) command listDatabases requires authentication

I noticed that I get the same error even if I enter invalid passwords / user.

However on primary a bad password will get this error:

Failed: can't create session: could not connect to server: connection() : auth error: sasl conversation error: unable to authenticate using mechanism "SCRAM-SHA-256": (AuthenticationFailed) Authentication failed.

This tells me that the secondary is not trying to authenticate. How can I get the secondary to perform the database dump when authentication is required?

Thank you