Application.php

<?php 
public function getAuthenticationService(ServerRequestInterface $request, ResponseInterface $response)
    {
        $service = new AuthenticationService();

        $fields = [
            'username' => 'email',
            'password' => 'password'
        ];

        //set config
        $service->setConfig([
            'unauthorizedRedirect' => ['controller' => 'Auth', 'action' => 'login'],
            'queryParam' => 'redirect',
        ]);
        // Load identifiers
        $service->loadIdentifier('Authentication.Password', compact('fields'));

        // Load the authenticators, you want session first
        $service->loadAuthenticator('Authentication.Session');
        $service->loadAuthenticator('Authentication.Form', [
            'fields' => $fields,
            'loginUrl' => ['controller' => 'Auth', 'action' => 'login'],
        ]);

        return $service;
    }