To enable this feature you need to
composer require robthree/twofactorauth
Enable google authenticator in your bootstrap.php file:
Config/bootstrap.php
Configure::write('Users.GoogleAuthenticator.login', true);
When the user log-in, he is requested (image 1) to inform the current validation code for your site in Google Authentation app (image 2), if this is the first time he access he need to add your site to Google Authentation by reading the QR code shown (image 1).
- Validation code page
- Google Authentation app