When a user does GridFS lookup, many (most? all?) drivers kick in a "ensureIndex" operation to ensure the queries will hit an index to improve performance.

This does not work for readOnly users, and will likely result in an error/exception being issued/thrown prohibiting the user to continue.

The upcoming GridFS spec added the following:

If this operation fails with a “not authorized” error while authenticated as a read-only user, GridFS should recover and continue. It is valid to use GridFS as a read-only user.