In CakePHP Authentication is done over the Authentication plugin:

It can be used for Token based authentication (also JWT). And for Form based authentication, usually over an email/unique username and password. It is used in most of our applications. Including CSABM where we implemented it with the help of Marc. Commands can be used to generate a superuser.

For authorization the Authorization plugin is used.