How to verify only the email address on user registration?

Question

I have a registration form. On the registration form the user can enter his username, email address and password and confirm password.

When the user registered, he/she should receive an email to verify his/her email address before login to the system.

Before email verification he/she should not be allowed to login to the system.

Also he/she should set his/her password on registration, no on email verification.

Is it possible?

I am using the logintoboggan with the Rules module. Through Rules, I set the status of a user to block upon registration. Then through rules with the event When the user account is validated (this event is provided by the logintoboggan rules integration module), I am activating the user.

But the problem is the loggintoboggan module automatically login the user upon email validation, which display an error message that the user is currently not active or blocked although the user has been actived. Because the rule event is triggered after validation of the email address.

Is there any way to prevent loggintoboggan module from automatically login the user upon email validation?

Answer 1

I would NOT block the user at first. That will for sure also not cause that error message you try to get rid of. And instead use the Flag module (in combination with the Rules module) to implement your logic like so:

• Use that same event When the user account is validated to flag that user with a flag labeled (say) "Validated".
• Any time you want to check if an authenticated user has been validated, you just have to verify if that "Validated" flag has been set for that user (which you can typically do with the Rules module also.

As a remedy to the fact that a user who registers can login to the site without email verification (as in your comment below), you can add some Rules logic like so:

• Rules Condition: if this user is not flagged (with that 'Validated' flag)
• Rules Action: perform redirect to user/logout

Possibly with an extra message you could set (in the same Rules Action) like "sorry, your account has not been validated yet, please do so and so first".