Question

I have a phonebook application – an internal app in our org.

I am investigating whether its possible to allow employees update their own record.

Does djangos auth system allow access to only your own details.

IE – if i looked up Active Directory for their username, and it corresponds to the username I have – then let them edit.

Answer 1

This is not supported directly in the admin interface.

If you’re talking about editing django.contrib.auth.models.User then I’d recommend just using a regular view instead of the admin interface. You may be able to inject custom validation to check that the request.user == user but it’s hacky.

If you’re talking about editing a UserProfile object then it’s easier to add custom validation to the admin form to check for authorization.