User registration; validate email but don't activate automatically

Question

is it possible to have the public registration form validate the users Email, but still require manual activation by a system administrator?

There's User Registration - Keep as inactive until verified by admin which I think will stop a clicked email confirmation link from activating the user...

but from what I can tell Craft's "email confirmation" is really just an "activate user via link"; so it's not really confirming the validity of the email nor storing that confirmation anywhere; it's just activating the user. Is that right or am I mis-understanding it?

Thanks, Matt

Answer 1

I think the approach Johannes posted as an answer to the question you linked to is a good one.

• Let the user activate the account via email. It makes sure the address exists and he has access to it, because he can't guess the activation URL without the mail.

• This activation only makes him become a member of a Users Group without any permissions at all (e.g. 'unverifiedUsers'). To restrict front end access do something like this:

  {% if currentUser.isInGroup('unverifiedUsers') %}
      <p>You don't have access rights. Please wait until an admin verifies you account. Thank you!</p>
  {% else %}
      {% include 'partial' %}
  {% endif %}
  

• Then let an admin do the manual verification: add the user to a group with the permissions you want.