Identity Server 3 Require confirmed email
<p>I have an identity server 3 implementation with functionality for registering new users. These users are then sent an email for confirmation. However the users can log in without confirming the email. I've later understood that the confirm email is just that, and not a "user confirmation" as I initially thought.</p>

<p>So how do I implement a "require confirmed email" policy?</p>

<p>I believe I've to implement a custom login action that checks the confirmed email flag, or are there somewhere else that is better suited?</p>