Authentication plugin migration in CakePHP 5.0: testing integration without production credentials

Direct answers

The mockAuth helper does not provide documented equivalent session handling for the CakePHP 5 Authentication plugin. It belongs to the legacy AuthComponent testing approach. Integration tests for the new plugin should use IntegrationTestCase with fixtures and a configured AuthenticationService instead of production credentials.

User state persistence differs between the two implementations. AuthComponent managed the session directly and exposed identity through $this->Auth->user(). The Authentication plugin resolves identity in middleware and exposes it through $this->Authentication->getIdentity(), storing it under a configurable session key. Because authentication runs before the controller, identity must survive the full request cycle in an integration test to be verified.

Migration timing depends on adapter parity and the CakePHP 6 deprecation schedule. AuthComponent remains available in CakePHP 5 but is deprecated and planned for removal in CakePHP 6. Projects should postpone if they rely on OAuth2 or JWT adapters without confirmed feature parity, or if they need a published removal date before refactoring. Projects can migrate now if the Form adapter covers their flows and they want to avoid a large CakePHP 6 upgrade.

Confirmed facts versus likely explanations

Item	Status	Detail
Authentication plugin role	Confirmed	First-party authentication system in CakePHP 5; AuthComponent deprecated.
Testing without production credentials	Confirmed	Use IntegrationTestCase with fixtures; do not hit production users.
mockAuth equivalence	Likely	No core helper with equivalent session handling for the new plugin has been documented.
Session storage mechanism	Likely	Plugin uses middleware plus AuthenticationComponent with a configurable session key; AuthComponent used direct session management.
Adapter feature parity	Uncertain	OAuth2 and JWT adapters may lack legacy behaviors; verify against your specific flows.

Verification steps

1. Check composer.json for cakephp/cakephp and cakephp/authentication versions.
2. Create a UsersFixture with hashed test credentials matching your application's password hasher.
3. Submit fixture credentials to the login route in an integration test and confirm identity on a subsequent protected request.
4. Compare $this->Authentication->getIdentity() with any legacy $this->Auth->user() calls still in use.

Missing diagnostic detail

Are you using a custom Identifier or non-default session storage such as Redis or Memcached? This affects whether session state persists across mocked requests and whether your test case needs additional configuration.