diff --git a/plugin/config.go b/plugin/config.go
index 1ba2a9f..1c97eb4 100644
--- a/plugin/config.go
+++ b/plugin/config.go
@@ -74,6 +74,14 @@ func (p *Plugin) Configure(global *plugin.GlobalOptions, options interface{}) {
 // Validate implements the Configurator interface.
 // Returns an error if validation of a plugin's configuration is failed.
 func (p *Plugin) Validate(options interface{}) error {
+    // TODO: do not fail with '(username|password) required for SCRAM-SHA-256'
+    //       when there is a username/password defined in the macros.
+    //
+    //       The trick to bypass the error is to use a fake username/password like :
+    //               mongodb://foo:bar@server:27017/db?authMechanism=SCRAM-SHA-256...
+    //       and the code at conn.go:create_mongodb() will set the credentials from the macros
+    //       when ${MONGODB.USER} is defined or will opts.ApplyURI(ck.rawUri) in the opposite case.
+
 	var opts PluginOptions
 
 	err := conf.Unmarshal(options, &opts)
diff --git a/plugin/conn.go b/plugin/conn.go
index 38ea77b..7d2a2dd 100644
--- a/plugin/conn.go
+++ b/plugin/conn.go
@@ -20,6 +20,7 @@ package plugin
 import (
 	"context"
 	"crypto/tls"
+	"strings"
 	"sync"
 	"time"
 
@@ -260,23 +261,96 @@ func (c *ConnManager) housekeeper(ctx context.Context, interval time.Duration) {
 	}
 }
 
-// create creates a new connection with given credentials.
+// decides how to create the connection depending on the given scheme.
 func (c *ConnManager) create(ck connKey, params map[string]string) (*MongoConn, error) {
-	opt, err := c.createOptions(ck.uri, params)
+    // For standard mongodb schemes let the driver do its job
+    if strings.HasPrefix(ck.rawUri, "mongodb://") || strings.HasPrefix(ck.rawUri, "mongodb+srv://") {
+        return c.create_mongodb(ck, params)
+    // Otherwise (tcp://) we use the standard behavior
+    } else {
+        return c.create_tcp(ck, params)
+    }
+}
+
+// create_mongodb creates a new connection 'mongodb://' or 'mongodb+srv://' using the given URI and credentials.
+func (c *ConnManager) create_mongodb(ck connKey, params map[string]string) (*MongoConn, error) {
+	Impl.Infof("Creating new MongoDB connection: %s", ck.rawUri)
+    ctx, cancel := context.WithTimeout(context.Background(), c.timeout)
+    defer cancel()
+    // Create the Options object
+    opts := options.Client()
+    // Use the same defaults as the normal behavior
+    /*
+    opts.SetHosts([]string{ck.uri.Addr()})
+	*/
+	opts.SetConnectTimeout(c.timeout)
+	opts.SetDirect(true)
+	opts.SetMaxPoolSize(1)
+	opts.SetServerSelectionTimeout(c.timeout)
+
+    if ck.uri.User() != "" {
+	    Impl.Infof("Setting credentials for user [%s]", ck.uri.User())
+        creds := options.Credential{
+            Username: ck.uri.User(),
+            Password: ck.uri.Password(),
+            PasswordSet: true,
+        }
+        // Let the driver set all options from the connection-string and set the credentials
+        opts.ApplyURI(ck.rawUri).SetAuth(creds)
+    } else {
+        // Let the driver set all options from the connection-string
+        opts.ApplyURI(ck.rawUri)
+    }
+
+    // The rest remains unmodified
+    client, err := mongo.Connect(ctx, opts)
+    if err != nil {
+        return nil, err
+    }
+
+	session, err := client.StartSession()
 	if err != nil {
 		return nil, err
 	}
 
-	client, err := mongo.NewClient(opt)
+	err = session.Client().Ping(ctx, readpref.Nearest())
 	if err != nil {
 		return nil, err
 	}
 
-	err = client.Connect(context.Background())
-	if err != nil {
-		return nil, err
+	c.connMutex.Lock()
+	defer c.connMutex.Unlock()
+
+	c.connections[ck] = &MongoConn{
+		addr:           ck.uri.Addr(),
+		timeout:        c.timeout,
+		lastTimeAccess: time.Now(),
+		session:        session,
 	}
 
+	Impl.Debugf("Created new connection: %s", ck.uri.Addr())
+
+	return c.connections[ck], nil
+}
+
+// create creates a new 'tcp://' connection with given credentials.
+func (c *ConnManager) create_tcp(ck connKey, params map[string]string) (*MongoConn, error) {
+	Impl.Infof("Creating new TCP connection: %s", ck.rawUri)
+    opt, err := c.createOptions(ck.uri, params)
+    if err != nil {
+        return nil, err
+    }
+
+    client, err := mongo.NewClient(opt)
+    if err != nil {
+        return nil, err
+    }
+
+    err = client.Connect(context.Background())
+    if err != nil {
+        return nil, err
+    }
+
 	session, err := client.StartSession()
 	if err != nil {
 		return nil, err
diff --git a/plugin/metrics.go b/plugin/metrics.go
index 98d439e..d4f2ab3 100644
--- a/plugin/metrics.go
+++ b/plugin/metrics.go
@@ -69,7 +69,7 @@ var metricHandlers = map[string]handlerFunc{
 var (
 	paramURI = metric.NewConnParam(uriParam, "URI to connect or session name.").
 			WithDefault(handlers.UriDefaults.Scheme + "://localhost:" + handlers.UriDefaults.Port).WithSession().
-			WithValidator(uri.URIValidator{Defaults: handlers.UriDefaults, AllowedSchemes: []string{"tcp"}})
+			WithValidator(uri.URIValidator{Defaults: handlers.UriDefaults, AllowedSchemes: []string{"tcp", "mongodb", "mongodb+srv"}})
 	paramUser        = metric.NewConnParam("User", "MongoDB user.")
 	paramPassword    = metric.NewConnParam("Password", "User's password.")
 	paramDatabase    = metric.NewParam("Database", "Database name.").WithDefault("admin")
diff --git a/plugin/mongodb.go b/plugin/mongodb.go
index 279bc78..4e9d815 100644
--- a/plugin/mongodb.go
+++ b/plugin/mongodb.go
@@ -77,7 +77,8 @@ func (p *Plugin) Export(key string, rawParams []string, ctx plugin.ContextProvid
 		return nil, err
 	}
 
-	p.Debugf("Params: %v", params)
+	// THIS IS LEAKING THE PASSWORD IN THE LOGS
+	//p.Debugf("Params: %v", params)
 
 	result, err = handleMetric(conn, params)
 	if err != nil {
