<p>I think the approach <a href="https://craftcms.stackexchange.com/a/5223/125">Johannes posted</a> as an answer to the question you linked to is a good one.</p>

<ul>
<li>Let the user activate the account via email. It makes sure the address exists and he has access to it, because he can't guess the activation URL without the mail.</li>
<li><p>This activation only makes him become a member of a Users Group without any permissions at all (e.g. 'unverifiedUsers'). To restrict front end access do something like this:</p>

<pre><code>{% if currentUser.isInGroup('unverifiedUsers') %}
    &lt;p&gt;You don't have access rights. Please wait until an admin verifies you account. Thank you!&lt;/p&gt;
{% else %}
    {% include 'partial' %}
{% endif %}
</code></pre></li>
<li><p>Then let an admin do the manual verification: add the user to a group with the permissions you want.</p></li>
</ul>

CC BY-SA 3.0
2015-02-09T13:51:05.280Z
Unfortunately that's not practical for my use case; I've a plugin that creates an entry on activation - I don't want that happening unless the user is also verified; so the verification needs to happen prior to the activation. With the Group approach, the page would be created prior to the admin vetting the user.
Matt Wilcox
CC BY-SA 3.0
2015-02-09T13:58:49.177Z
@MattWilcox you could rewrite the plugin and listen to `users.onSaveUser` instead of `users.onActivateUser` events and conditionally create that "first entry" if the user is a) in the right user group (not 'unverifiedUsers' any more) and b) no entry by that user exists.
carlcs
CC BY-SA 3.0
2015-02-09T12:47:09.263Z
2015-02-09T12:47:09.263Z
2017-04-13T12:51:00.253Z
carlcs
<p>is it possible to have the public registration form validate the users Email, but still require manual activation by a system administrator?</p>

<p>There's <a href="https://craftcms.stackexchange.com/questions/5216/user-registration-keep-as-inactive-until-verified-by-admin">User Registration - Keep as inactive until verified by admin</a> which I think will stop a clicked email confirmation link from activating the user...</p>

<p>but from what I can tell Craft's "email confirmation" is really just an "activate user via link"; so it's not really confirming the validity of the email nor storing that confirmation anywhere; it's just activating the user. Is that right or am I mis-understanding it?</p>

<p>Thanks,
Matt</p>

<users><registration>
User registration; validate email but don't activate automatically
# User registration; validate email but don't activate automatically

(Asked by: username_0 on 2015-02-09)

is it possible to have the public registration form validate the users Email, but still require manual activation by a system administrator?

There's [User Registration - Keep as inactive until verified by admin](https://craftcms.stackexchange.com/questions/5216/user-registration-keep-as-inactive-until-verified-by-admin) which I think will stop a clicked email confirmation link from activating the user...

but from what I can tell Craft's "email confirmation" is really just an "activate user via link"; so it's not really confirming the validity of the email nor storing that confirmation anywhere; it's just activating the user. Is that right or am I mis-understanding it?

Thanks,
Matt

**Tags:** users, registration

---

## 1 answers

### Answer by username_1 on 2015-02-09. Score: 2

I think the approach Johannes posted as an answer to the question you linked to is a good one.

Let the user activate the account via email. It makes sure the address exists and he has access to it, because he can't guess the activation URL without the mail.
This activation only makes him become a member of a Users Group without any permissions at all (e.g. 'unverifiedUsers'). To restrict front end access do something like this:
{% if currentUser.isInGroup('unverifiedUsers') %}
    You don't have access rights. Please wait until an admin verifies you account. Thank you!
{% else %}
    {% include 'partial' %}
{% endif %}

Then let an admin do the manual verification: add the user to a group with the permissions you want.

> **Comments:**
> **username_0**: Unfortunately that's not practical for my use case; I've a plugin that creates an entry on activation - I don't want that happening unless the user is also verified; so the verification needs to happen prior to the activation. With the Group approach, the page would be created prior to the admin vetting the user.  
> **username_1**: @MattWilcox you could rewrite the plugin and listen to `users.onSaveUser` instead of `users.onActivateUser` events and conditionally create that "first entry" if the user is a) in the right user group (not 'unverifiedUsers' any more) and b) no entry by that user exists.  

---

