The authentication database (https://docs.mongodb.com/manual/core/security-users/#user-authentication-database) can be any MongoDB database in which you have defined users and roles. The authentication database chosen for a given user depends on what level of access that user is to be assigned. If the user has privileges in many different databases, it doesn't make sense to define the same user multiple times in each database. Instead, it makes more sense to define the user in a single central database, and to specify the central database as the authentication database when attempting access.
On the other hand, it's quite possible that you wish to confine the activities of a particular database user to one single database. In this case, you could create the user in that one database, and assign the appropriate privileges. We now move our attention to the different authentication mechanisms available in MongoDB.
