diff --git a/src/app/Http/Controllers/API/SignupController.php b/src/app/Http/Controllers/API/SignupController.php
index c910c974..8878b23d 100644
--- a/src/app/Http/Controllers/API/SignupController.php
+++ b/src/app/Http/Controllers/API/SignupController.php
@@ -1,260 +1,263 @@
 <?php
 
 namespace App\Http\Controllers\API;
 
 use App\Http\Controllers\Controller;
 use App\Jobs\SignupVerificationEmail;
 use App\Jobs\SignupVerificationSMS;
 use App\SignupCode;
 use App\User;
 
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Support\Str;
 
 /**
  * Signup process API
  */
 class SignupController extends Controller
 {
     /** @var SignupCode A verification code object */
     protected $code;
 
 
     /**
      * Starts signup process.
      *
      * Verifies user name and email/phone, sends verification email/sms message.
      * Returns the verification code.
      *
      * @param Illuminate\Http\Request HTTP request
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function init(Request $request)
     {
         // Check required fields
         $v = Validator::make(
             $request->all(),
             [
                 'email' => 'required',
                 'name' => 'required',
             ]
         );
 
         if ($v->fails()) {
             return response()->json(['status' => 'error', 'errors' => $v->errors()], 422);
         }
 
         // Validate user email (or phone)
         if ($error = $this->validatePhoneOrEmail($request->email, $is_phone)) {
             return response()->json(['status' => 'error', 'errors' => ['email' => __($error)]], 422);
         }
 
         // Generate the verification code
         $code = SignupCode::create([
                 'data' => [
                     'email' => $request->email,
                     'name' => $request->name,
                 ]
         ]);
 
         // Send email/sms message
         if ($is_phone) {
             SignupVerificationSMS::dispatch($code);
         } else {
             SignupVerificationEmail::dispatch($code);
         }
 
         return response()->json(['status' => 'success', 'code' => $code->code]);
     }
 
     /**
      * Validation of the verification code.
      *
      * @param Illuminate\Http\Request HTTP request
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function verify(Request $request)
     {
         // Validate the request args
         $v = Validator::make(
             $request->all(),
             [
                 'code' => 'required',
                 'short_code' => 'required',
             ]
         );
 
         if ($v->fails()) {
             return response()->json(['status' => 'error', 'errors' => $v->errors()], 422);
         }
 
         // Validate the verification code
         $code = SignupCode::find($request->code);
 
         if (empty($code)
             || $code->isExpired()
             || Str::upper($request->short_code) !== Str::upper($code->short_code)
         ) {
             $errors = ['short_code' => "The code is invalid or expired."];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         // For signup last-step mode remember the code object, so we can delete it
         // with single SQL query (->delete()) instead of two (::destroy())
         $this->code = $code;
 
         // Return user name and email/phone from the codes database on success
         return response()->json([
                 'status' => 'success',
                 'email' => $code->data['email'],
                 'name' => $code->data['name'],
         ]);
     }
 
     /**
      * Finishes the signup process by creating the user account.
      *
      * @param Illuminate\Http\Request HTTP request
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function signup(Request $request)
     {
         // Validate input
         $v = Validator::make(
             $request->all(),
             [
                 'login' => 'required|min:2',
                 'password' => 'required|min:4|confirmed',
             ]
         );
 
         if ($v->fails()) {
             return response()->json(['status' => 'error', 'errors' => $v->errors()], 422);
         }
 
         $login = $request->login . '@' . \config('app.domain');
 
         // Validate login (email)
         if ($error = $this->validateEmail($login, true)) {
             return response()->json(['status' => 'error', 'errors' => ['login' => $error]], 422);
         }
 
         // Validate verification codes (again)
         $v = $this->verify($request);
         if ($v->status() !== 200) {
             return $v;
         }
 
+        // Get user name/email from the verification code database
         $code_data  = $v->getData();
         $user_name  = $code_data->name;
         $user_email = $code_data->email;
 
         // We allow only ASCII, so we can safely lower-case the email address
         $login = Str::lower($login);
 
         $user = User::create(
             [
-                // TODO: Save the external email (or phone)
                 'name' => $user_name,
                 'email' => $login,
                 'password' => $request->password,
             ]
         );
 
+        // Save the external email in user settings
+        $user->setSettings(['external_email' => $user_email]);
+
         // Remove the verification code
         $this->code->delete();
 
         $token = auth()->login($user);
 
         return response()->json([
                 'status' => 'success',
                 'access_token' => $token,
                 'token_type' => 'bearer',
                 'expires_in' => Auth::guard()->factory()->getTTL() * 60,
         ]);
     }
 
     /**
      * Checks if the input string is a valid email address or a phone number
      *
      * @param string $email     Email address or phone number
      * @param bool   &$is_phone Will be set to True if the string is valid phone number
      *
      * @return string Error message label on validation error
      */
     protected function validatePhoneOrEmail($input, &$is_phone = false)
     {
         $is_phone = false;
 
         return $this->validateEmail($input);
 
         // TODO: Phone number support
 /*
         if (strpos($input, '@')) {
             return $this->validateEmail($input);
         }
 
         $input = str_replace(array('-', ' '), '', $input);
 
         if (!preg_match('/^\+?[0-9]{9,12}$/', $input)) {
             return 'validation.noemailorphone';
         }
 
         $is_phone = true;
 */
     }
 
     /**
      * Email address validation
      *
      * @param string $email  Email address
      * @param bool   $signup Enables additional checks for signup mode
      *
      * @return string Error message label on validation error
      */
     protected function validateEmail($email, $signup = false)
     {
         $v = Validator::make(['email' => $email], ['email' => 'required|email']);
 
         if ($v->fails()) {
             return 'validation.emailinvalid';
         }
 
         list($local, $domain) = explode('@', $email);
 
         // don't allow @localhost and other no-fqdn
         if (strpos($domain, '.') === false) {
             return 'validation.emailinvalid';
         }
 
         // Extended checks for an address that is supposed to become a login to Kolab
         if ($signup) {
             // Local part validation
             if (!preg_match('/^[A-Za-z0-9_.-]+$/', $local)) {
                 return 'validation.emailinvalid';
             }
 
             // Check if specified domain is allowed for signup
             if ($domain != \config('app.domain')) {
                 return 'validation.emailinvalid';
             }
 
             // Check if the local part is not one of exceptions
             $exceptions = '/^(admin|administrator|sales|root)$/i';
             if (preg_match($exceptions, $local)) {
                 return 'validation.emailexists';
             }
 
             // Check if user with specified login already exists
             // TODO: Aliases
             if (User::where('email', $email)->first()) {
                 return 'validation.emailexists';
             }
         }
     }
 }
diff --git a/src/app/User.php b/src/app/User.php
index 1e5a8f7d..010c8b38 100644
--- a/src/app/User.php
+++ b/src/app/User.php
@@ -1,176 +1,190 @@
 <?php
 
 namespace App;
 
 use Illuminate\Notifications\Notifiable;
 use Illuminate\Contracts\Auth\MustVerifyEmail;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Iatstuti\Database\Support\NullableFields;
 use Tymon\JWTAuth\Contracts\JWTSubject;
 
 use App\Traits\UserSettingsTrait;
 
 /**
  * The eloquent definition of a User.
  */
 class User extends Authenticatable implements JWTSubject
 {
     use Notifiable;
     use NullableFields;
     use UserSettingsTrait;
 
     // change the default primary key type
     public $incrementing = false;
     protected $keyType = 'bigint';
 
     /**
      * The attributes that are mass assignable.
      *
      * @var array
      */
     protected $fillable = [
         'name', 'email', 'password', 'password_ldap'
     ];
 
     /**
      * The attributes that should be hidden for arrays.
      *
      * @var array
      */
     protected $hidden = [
         'password', 'password_ldap', 'remember_token',
     ];
 
     protected $nullable = [
         'name',
         'password',
         'password_ldap'
     ];
 
     /**
      * The attributes that should be cast to native types.
      *
      * @var array
      */
     protected $casts = [
         'email_verified_at' => 'datetime',
     ];
 
     /**
      * Any wallets on which this user is a controller.
      *
      * @return Wallet[]
      */
     public function accounts()
     {
         return $this->belongsToMany(
             'App\Wallet',       // The foreign object definition
             'user_accounts',    // The table name
             'user_id',        // The local foreign key
             'wallet_id'       // The remote foreign key
         );
     }
 
     /**
      * List the domains to which this user is entitled.
      *
      * @return Domain[]
      */
     public function domains()
     {
         $domains = Domain::whereRaw(
             sprintf(
                 '(type & %s) AND (status & %s)',
                 Domain::TYPE_PUBLIC,
                 Domain::STATUS_ACTIVE
             )
         )->get();
 
         foreach ($this->entitlements()->get() as $entitlement) {
             if ($entitlement->entitleable instanceof Domain) {
                 $domain = Domain::find($entitlement->entitleable_id);
                 \Log::info("Found domain {$domain->namespace}");
                 $domains[] = $domain;
             }
         }
 
         foreach ($this->accounts()->get() as $wallet) {
             foreach ($wallet->entitlements()->get() as $entitlement) {
                 if ($entitlement->entitleable instanceof Domain) {
                     $domain = Domain::find($entitlement->entitleable_id);
                     \Log::info("Found domain {$domain->namespace}");
                     $domains[] = $domain;
                 }
             }
         }
 
         return $domains;
     }
 
     public function entitlement()
     {
         return $this->morphOne('App\Entitlement', 'entitleable');
     }
 
     /**
      * Entitlements for this user.
      *
      * @return Entitlement[]
      */
     public function entitlements()
     {
         return $this->hasMany('App\Entitlement', 'owner_id', 'id');
     }
 
     public function addEntitlement($entitlement)
     {
         if (!$this->entitlements()->get()->contains($entitlement)) {
             return $this->entitlements()->save($entitlement);
         }
     }
 
     public function settings()
     {
         return $this->hasMany('App\UserSetting', 'user_id');
     }
 
+    /**
+     * Return single user setting value
+     *
+     * @param string $key Setting key name
+     *
+     * @return string Setting value
+     */
+    public function getSetting(string $key, $default = null)
+    {
+        $setting = $this->settings->where('key', $key)->first();
+
+        return $setting ? $setting->value : $default;
+    }
+
     /**
      * Wallets this user owns.
      *
      * @return Wallet[]
      */
     public function wallets()
     {
         return $this->hasMany('App\Wallet');
     }
 
     public function getJWTIdentifier()
     {
         return $this->getKey();
     }
 
     public function getJWTCustomClaims()
     {
         return [];
     }
 
     public function setPasswordAttribute($password)
     {
         if (!empty($password)) {
             $this->attributes['password'] = bcrypt($password, [ "rounds" => 12 ]);
             $this->attributes['password_ldap'] = '{SSHA512}' . base64_encode(
                 pack('H*', hash('sha512', $password))
             );
         }
     }
 
     public function setPasswordLdapAttribute($password)
     {
         if (!empty($password)) {
             $this->attributes['password'] = bcrypt($password, [ "rounds" => 12 ]);
             $this->attributes['password_ldap'] = '{SSHA512}' . base64_encode(
                 pack('H*', hash('sha512', $password))
             );
         }
     }
 }
diff --git a/src/tests/Feature/Controller/SignupTest.php b/src/tests/Feature/Controller/SignupTest.php
index 603e1d63..e34792a4 100644
--- a/src/tests/Feature/Controller/SignupTest.php
+++ b/src/tests/Feature/Controller/SignupTest.php
@@ -1,387 +1,389 @@
 <?php
 
 namespace Tests\Feature\Controller;
 
 use App\Http\Controllers\API\SignupController;
 use App\SignupCode;
 use App\User;
 
 use Tests\TestCase;
 
 class SignupTest extends TestCase
 {
     /**
      * {@inheritDoc}
      *
      * @return void
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $user = User::firstOrCreate(['email' => 'SignupControllerTest1@' . \config('app.domain')]);
     }
 
     /**
      * {@inheritDoc}
      *
      * @return void
      */
     public function tearDown(): void
     {
         User::where('email', 'SignupLogin@' . \config('app.domain'))
             ->orWhere('email', 'SignupControllerTest1@' . \config('app.domain'))
             ->delete();
 
         parent::tearDown();
     }
 
     /**
      * Test signup initialization with invalid input
      *
      * @return void
      */
     public function testSignupInitInvalidInput()
     {
         // Empty input data
         $data = [];
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertArrayHasKey('email', $json['errors']);
         $this->assertArrayHasKey('name', $json['errors']);
 
         // Data with missing name
         $data = [
             'email' => 'UsersApiControllerTest1@UsersApiControllerTest.com',
             'password' => 'simple123',
             'password_confirmation' => 'simple123'
         ];
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('name', $json['errors']);
 
         // Data with invalid email (but not phone number)
         $data = [
             'email' => '@example.org',
             'name' => 'Signup User',
             'password' => 'simple123',
             'password_confirmation' => 'simple123'
         ];
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('email', $json['errors']);
 
         // TODO: Test phone validation
     }
 
     /**
      * Test signup initialization with valid input
      *
      * @return array
      */
     public function testSignupInitValidInput()
     {
         $data = [
             'email' => 'testuser@external.com',
             'name' => 'Signup User',
             'password' => 'simple123',
             'password_confirmation' => 'simple123'
         ];
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(200);
         $this->assertCount(2, $json);
         $this->assertSame('success', $json['status']);
         $this->assertNotEmpty($json['code']);
 
         // TODO: Test verification email job/event
 
         return [
             'code' => $json['code'],
             'email' => $data['email'],
             'name' => $data['name'],
         ];
     }
 
     /**
      * Test signup code verification with invalid input
      *
      * @depends testSignupInitValidInput
      * @return void
      */
     public function testSignupVerifyInvalidInput(array $result)
     {
         // Empty data
         $data = [];
 
         $response = $this->post('/api/auth/signup/verify', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertArrayHasKey('code', $json['errors']);
         $this->assertArrayHasKey('short_code', $json['errors']);
 
         // Data with existing code but missing short_code
         $data = [
             'code' => $result['code'],
         ];
 
         $response = $this->post('/api/auth/signup/verify', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('short_code', $json['errors']);
 
         // Data with invalid short_code
         $data = [
             'code' => $result['code'],
             'short_code' => 'XXXX',
         ];
 
         $response = $this->post('/api/auth/signup/verify', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('short_code', $json['errors']);
 
         // TODO: Test expired code
     }
 
     /**
      * Test signup code verification with valid input
      *
      * @depends testSignupInitValidInput
      *
      * @return array
      */
     public function testSignupVerifyValidInput(array $result)
     {
         $code = SignupCode::find($result['code']);
         $data = [
             'code' => $code->code,
             'short_code' => $code->short_code,
         ];
 
         $response = $this->post('/api/auth/signup/verify', $data);
         $json = $response->json();
 
         $response->assertStatus(200);
         $this->assertCount(3, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame($result['email'], $json['email']);
         $this->assertSame($result['name'], $json['name']);
 
         return $result;
     }
 
     /**
      * Test last signup step with invalid input
      *
      * @depends testSignupVerifyValidInput
      * @return void
      */
     public function testSignupInvalidInput(array $result)
     {
         // Empty data
         $data = [];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertArrayHasKey('login', $json['errors']);
         $this->assertArrayHasKey('password', $json['errors']);
 
         // Passwords do not match
         $data = [
             'login' => 'test',
             'password' => 'test',
             'password_confirmation' => 'test2',
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('password', $json['errors']);
 
         // Login too short
         $data = [
             'login' => '1',
             'password' => 'test',
             'password_confirmation' => 'test',
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('login', $json['errors']);
 
         // Login invalid
         $data = [
             'login' => 'żżżżż',
             'password' => 'test',
             'password_confirmation' => 'test',
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('login', $json['errors']);
 
         // Data with invalid short_code
         $data = [
             'login' => 'TestLogin',
             'password' => 'test',
             'password_confirmation' => 'test',
             'code' => $result['code'],
             'short_code' => 'XXXX',
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('short_code', $json['errors']);
     }
 
     /**
      * Test last signup step with valid input (user creation)
      *
      * @depends testSignupVerifyValidInput
      * @return void
      */
     public function testSignupValidInput(array $result)
     {
         $identity = \strtolower('SignupLogin@') . \config('app.domain');
 
         // Make sure the user does not exist (it may happen when executing
         // tests again after failure)
         User::where('email', $identity)->delete();
 
         $code = SignupCode::find($result['code']);
         $data = [
             'login' => 'SignupLogin',
             'password' => 'test',
             'password_confirmation' => 'test',
             'code' => $code->code,
             'short_code' => $code->short_code,
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(200);
         $this->assertCount(4, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame('bearer', $json['token_type']);
         $this->assertTrue(!empty($json['expires_in']) && is_int($json['expires_in']) && $json['expires_in'] > 0);
         $this->assertNotEmpty($json['access_token']);
 
         // Check if the code has been removed
         $this->assertNull(SignupCode::where($result['code'])->first());
 
         // Check if the user has been created
         $user = User::where('email', $identity)->first();
 
         $this->assertNotEmpty($user);
         $this->assertSame($identity, $user->email);
         $this->assertSame($result['name'], $user->name);
-//        $this->assertSame($result['email'], $user->settings->external_email);
 
-        // TODO: Check if the access token works?
+        // Check external email in user settings
+        $this->assertSame($result['email'], $user->getSetting('external_email', 'not set'));
+
+        // TODO: Check if the access token works
     }
 
     /**
      * List of email address validation cases for testValidateEmail()
      *
      * @return array Arguments for testValidateEmail()
      */
     public function dataValidateEmail()
     {
         // To access config from dataProvider method we have to refreshApplication() first
         $this->refreshApplication();
         $domain = \config('app.domain');
 
         return [
             // general cases (invalid)
             ['', false, 'validation.emailinvalid'],
             ['example.org', false, 'validation.emailinvalid'],
             ['@example.org', false, 'validation.emailinvalid'],
             ['test@localhost', false, 'validation.emailinvalid'],
             // general cases (valid)
             ['test@domain.tld', false, null],
             ['&@example.org', false, null],
             // kolab identity cases
             ['admin@' . $domain, true, 'validation.emailexists'],
             ['administrator@' . $domain, true, 'validation.emailexists'],
             ['sales@' . $domain, true, 'validation.emailexists'],
             ['root@' . $domain, true, 'validation.emailexists'],
             ['&@' . $domain, true, 'validation.emailinvalid'],
             ['testnonsystemdomain@invalid.tld', true, 'validation.emailinvalid'],
             // existing account
             ['SignupControllerTest1@' . $domain, true, 'validation.emailexists'],
             // valid for signup
             ['test.test@' . $domain, true, null],
             ['test_test@' . $domain, true, null],
             ['test-test@' . $domain, true, null],
         ];
     }
 
     /**
      * Signup email validation.
      *
      * Note: Technicly these are mostly unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      *
      * @dataProvider dataValidateEmail
      */
     public function testValidateEmail($email, $signup, $expected_result)
     {
         $method = new \ReflectionMethod('App\Http\Controllers\API\SignupController', 'validateEmail');
         $method->setAccessible(true);
 
         $is_phone = false;
         $result = $method->invoke(new SignupController(), $email, $signup);
 
         $this->assertSame($expected_result, $result);
     }
 }