djadhere/accounts/admin.py

from django.contrib import admin
from django.contrib.auth.models import User
from django.contrib.auth.admin import UserAdmin as AuthUserAdmin
from django.core.exceptions import PermissionDenied


from adhesions.admin import ProfileInline, AdherentInline


class UserAdmin(AuthUserAdmin):
    inlines = (ProfileInline, AdherentInline,)

    def get_readonly_fields(self, request, obj=None):
        readonly_fields = super().get_readonly_fields(request, obj)
        if not request.user.is_superuser:
            readonly_fields += ('username',)
        return readonly_fields

    def get_fieldsets(self, request, obj=None):
        if request.user.is_superuser:
            return AuthUserAdmin.fieldsets
        else:
            return (
                (None, {'fields': ('username',)}),
                AuthUserAdmin.fieldsets[1],
            )

    def user_change_password(self, request, id):
        if not request.user.is_superuser:
            raise PermissionDenied
        return super().user_change_password(request, id)


admin.site.unregister(User)
admin.site.register(User, UserAdmin)