From http://book.cakephp.org/3.0/en/controllers/components/authentication.html#suggested-reading-before-continuing

LoginAction.php

<?php

...

    /**
     * HTTP POST handler
     *
     * @return void|\Cake\Network\Response
     */
    protected function _post()
    {
        $user = $this->_controller()->Auth->identify();

        // when it's successful return $this->_success($subject);

        // when it's error, return $this->_error($subject);
    }

UsersController.php

<?php
public function login()
{
    if ($this->request->is('post')) {
        $user = $this->Auth->identify();
        if ($user) {
            $this->Auth->setUser($user);
            if ($this->Auth->authenticationProvider()->needsPasswordRehash()) {
                $user = $this->Users->get($this->Auth->user('id'));
                $user->password = $this->request->data('password');
                $this->Users->save($user);
            }
            return $this->redirect($this->Auth->redirectUrl());
        }
        ...
    }
}