Registration

If you allow it, external users can register. This can be turned off either at an application setting level or a auth model level.

On completion of the registration form, a user is created with verified = false; if they try and login immediately without verification, it will notify them that the account still needs verification. A user in this "pending" state can be seen by admins in the user listing (you can filter by pending users) - where they can push through the user manually if required.

Once they receive the email which contains the verification link, clicking on it looks up that user by that verification token, and approves the account. They are then free to login.