There's more in this issue. The reason why it does not work is that strong params drops login parameter if user is editing himself/herself, see https://github.com/theforeman/foreman/blob/3703af267f316676ce571a0ca00563c8c3565168/app/controllers/concerns/foreman/controller/parameters/user.rb#L27-L33

The second part is that we disable the login field for users with login == 'admin', see https://github.com/theforeman/foreman/blob/3703af267f316676ce571a0ca00563c8c3565168/app/views/users/_form.html.erb#L24 that does not make sense since we can have more than one admin.

Changing the login should be supported including user themselves in case the auth source is INTERNAL. For external auth sources this would be dangerous. After discussion with Evgeni and Ewoud, we came to conclusion that updating login and other sensitive fields (auth source) should be only allowed to user with edit_users permission, while self editing of other attributes (e.g. email) should be allowed to everyone.

So the properly fix this issue, following is required:
1) keep fields disabled only while self editing and current user does not have edit_users permission, the disabled field should have a hover tooltip explaining why the field is disabled
2) update strong params to follow the same logic, accepting login and auth source fields only for users with edit_users permission

Applied in changeset 02d1635cbfca6e96d46b50d27232e152efb58d9f.