BaseAuthenticate idea

gistfile1.php

<?php
abstract class BaseAuthenticate implements EventListenerInterface
{

    // snip..

    protected function _findUser($query, $username = null, $password = null)
    {
        $fields = $this->_config['fields'];

        if (!$query instanceof Query) {
            $password = $username;
            $username = $query;
            $query = $this->_find($username, $password);
        }

        $result = $query->first();
        if (empty($result)) {
            return false;
        }

        if ($password !== null) {
            $hasher = $this->passwordHasher();
            $hashedPassword = $result->get($fields['password']);
            if (!$hasher->check($password, $hashedPassword)) {
                return false;
            }

            $this->_needsPasswordRehash = $hasher->needsRehash($hashedPassword);
            $result->unsetProperty($fields['password']);
        }

        return $result->toArray();
    }

    protected function _find($username, $password = null)
    {
        $userModel = $this->_config['userModel'];
        list(, $model) = pluginSplit($userModel);
        $fields = $this->_config['fields'];

        $conditions = [$model . '.' . $fields['username'] => $username];

        $scope = $this->_config['scope'];
        if ($scope) {
            $conditions = array_merge($conditions, $scope);
        }

        $table = TableRegistry::get($userModel)->find('all');

        $contain = $this->_config['contain'];
        if ($contain) {
            $table = $table->contain($contain);
        }

        $query = $table
            ->where($conditions)

        return $query;
    }