BaseAuthenticate idea more logical I think

    protected function _findUser($username, $password = null)
    {
        $userModel = $this->_config['userModel'];
        list(, $model) = pluginSplit($userModel);
        $fields = $this->_config['fields'];

        $conditions = [$model . '.' . $fields['username'] => $username];

        $scope = $this->_config['scope'];
        if ($scope) {
            $conditions = array_merge($conditions, $scope);
        }

        $table = TableRegistry::get($userModel)->find('all');

        $contain = $this->_config['contain'];
        if ($contain) {
            $table = $table->contain($contain);
        }

        $result = $table
            ->where($conditions)
            ->first();

        if (empty($result)) {
            return false;
        }

        if ($password !== null) {
            $hasher = $this->passwordHasher();
            $hashedPassword = $result->get($fields['password']);
            if (!$hasher->check($password, $hashedPassword)) {
                return false;
            }

            $this->_needsPasswordRehash = $hasher->needsRehash($hashedPassword);
            $result->unsetProperty($fields['password']);
        }

        return $result->toArray();
    }