Due to SERVER-4692, it is no longer possible to do a full mongodump using a read-only user. SERVER-9012 has been proposed as a solution to this. However, but that means it is still impossible to dump all data using a read-only account.

I believe it should be possible to do such a mongodump, including dumping all users, so that they can be restored correctly. Here are a couple of ways it might be possible:

• Allow read-only admin users access to system.users collections.
• Add a another user permissions beyond read-only, that would allow access to system.users collections.
• Do some sort of encryption of system.users when read by read-only users that can only be decrypted by a user with full access. That allows the encrypted version to be backed up, and then when restored, a user with write access has to do the restore, so they could do the decrypting before restore. This is obviously much more involved than the previous 2, but I'm just trying to throw out possible alternatives.