Programmatic user registration not forcing user to activate account

Question

I'm manually creating a user and then sending a notification email as follows:

$new_user = array(
  'name' => $username,
  'pass' => $password, 
  'mail' => $email,
  'status' => 1,
  'init' => $email,
);            

$account = user_save(drupal_anonymous_user(), $new_user);
 _user_mail_notify('register_no_approval_required', $account);  

However, the user is able to login right away. How can I enforce account activation? I have it enabled in the admin panel

Answer 1

You can use the LoginToboggan Prevent preauth module is available for Drupal 6 and 7. And it realy does all the stuff. We can have "Email account activation without admin approval and also a user set password".

Code:

    $new_user = array(
      'name' => $username,
      'pass' => $password, 
      'mail' => $email,
      'status' => 1,
      'init' => $email,
      'roles' => array(logintoboggan_validating_id() => TRUE)
    );  
   $account = user_save(NULL, $new_user);
   // Send mail with account confirmation
   _user_mail_notify('register_no_approval_required', $account);

P.S. Don't forgot to uncheck 'Immediate login' option.

Answer 2

This can't be accomplished directly with Drupal.

When a user registers and 'email verification' is enabled for the website, Drupal creates a random password for the user and sends them a password reset link via email. The user CAN login, but that would require knowledge of the random password.

The only way I was able to accomplish this was by setting the users' status to 0, then sending a custom email with a link to a custom verification page. The link contains the ID of the user and a hash of a private key concatenated with the user's email. On the verification page, I pull the user's email from the database based on the ID in the URL, concatenate the private key to the email and hash it, if the hash matches the hash in the URL, I set the user's status to 1, enabling the user to login.