The AuthenticationMiddleware will call your src/Application.php getAuthenticationService() method and this is where you configure your Authentication (including installing the cookie authenticator).
This example shows how to add authenticators https://book.cakephp.org/authentication/2/en/index.html#getting-started
This diagram will give you an idea of how the AuthenticationMiddleware manages the process AuthenticationMiddleware: overview of version 2.0
Once you’ve added all the authenticators and identifiers, each authenticator will try to confirm the request by using each identifier. Once a combination succeeds, the attempts ends and the request proceeds.