# ReadOnly username for the 'admin' user

**URL:** <https://forum.djangoproject.com/t/readonly-username-for-the-admin-user/2085>\
**Category:** Using Django\
**Created:** [April 23, 2020, 12:20pm UTC](https://forum.djangoproject.com/t/readonly-username-for-the-admin-user/2085 "2020-04-23T12:20:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Francois](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/francois/32/2120_2.png) [@Francois](https://forum.djangoproject.com/u/Francois)\
**Post date:** [April 23, 2020, 12:20pm UTC](https://forum.djangoproject.com/t/readonly-username-for-the-admin-user/2085/1 "2020-04-23T12:20:10Z")

</div>

Hi,

I customized the user model with inheriting the AbstractUser.

I want all the users to have the username editable, except the user which has the username ‘admin’.

I wanted to create two user model (one for the common users and another one for the admin) but Django only accepts one model.

Do you have a solution on how to have the user admin with readonly username field ?

I could prevent the username from being edited using permissions on my views, but I think it’s more secure and strong to do it directly on the database.

Thanks for your help.

---

<div class="post-metadata">

**Author:** ![adamchainz](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/adamchainz/32/26_2.png) [@adamchainz](https://forum.djangoproject.com/u/adamchainz)\
**Post date:** [April 23, 2020, 12:42pm UTC](https://forum.djangoproject.com/t/readonly-username-for-the-admin-user/2085/2 "2020-04-23T12:42:18Z")

</div>

You should solve this in your form’s ` __init__ ` method instead, conditionally making the field editable.

For example (untested):

```auto
class MyUserForm(...):
    ...
    def __init__ (self, *args, **kwargs):
         super(). __init__ (*args, **kwargs)
         self.fields['username'].disabled = (self.instance.is_superuser)

```

---

<div class="post-metadata">

**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\
**Post date:** [April 23, 2020, 12:50pm UTC](https://forum.djangoproject.com/t/readonly-username-for-the-admin-user/2085/3 "2020-04-23T12:50:33Z")

</div>

Are you talking about doing this within the Django Admin, or within your own forms?

If you’re talking about doing this within the Admin facility, you could try implementing your own [get\_readonly\_fields](https://docs.djangoproject.com/en/3.0/ref/contrib/admin/#django.contrib.admin.ModelAdmin.get_readonly_fields) that checks to see if the current user is admin, and if so, returning the username field.

Regarding your other statement about security, yes, there is a potential issue, depending upon usage of your database. But if your Django app is the only application using this database, it’s much less an issue. If you have control over the application layer, it’s quite common to manage access on that layer and not try to push that management back on to the database. (There’s an argument to be made that keeping all access controls in the same layer is more secure, since you don’t have to account for any interactions or gaps between layers.)

Ken

---

<div class="post-metadata">

**Author:** ![Francois](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/francois/32/2120_2.png) [@Francois](https://forum.djangoproject.com/u/Francois)\
**Post date:** [April 23, 2020, 1:07pm UTC](https://forum.djangoproject.com/t/readonly-username-for-the-admin-user/2085/4 "2020-04-23T13:07:50Z")

</div>

Many thanks for your help.

From what I understand it’s not possible to implement it on the database side.

> You should solve this in your form’s ` __init__ ` method instead, conditionally making the field editable.
> 
> For example (untested):
> 
> ```auto
> class MyUserForm(...):
> ...
> def __init__ (self, *args, **kwargs):
> super(). __init__ (*args, **kwargs)
> self.fields['username'].disabled = (self.instance.is_superuser)
> 
> ```

Since I am using Djang Rest Framework I think I have to find the equivalent of your code in my User serializer code. I will try to find a solution in that way (if you have also have this precious piece of code that would be great 🙂 )

---

<div class="post-metadata">

**Author:** ![Francois](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/francois/32/2120_2.png) [@Francois](https://forum.djangoproject.com/u/Francois)\
**Post date:** [April 23, 2020, 1:31pm UTC](https://forum.djangoproject.com/t/readonly-username-for-the-admin-user/2085/5 "2020-04-23T13:31:35Z")

</div>

adamchainz, your code is Great.

Actually it also works just fine with my serializer, thanks !