src/Web/User.php
public function login(IdentityInterface $identity, $duration = 0)
    {
        //Using root resolve function for promise conversion
        return resolve(true)
            ->then(function() use (&$identity, $duration) {
                return $this->beforeLogin($identity, false, $duration);
            })->then(function() use (&$identity, $duration) {
                $this->switchIdentity($identity, $duration);
                $id = $identity->getId();
                $ip = $this->request->getUserIP();
                if ($this->enableSession) {
                    $log = "User '$id' logged in from $ip with duration $duration.";
                } else {
                    $log = "User '$id' logged in from $ip. Session not enabled.";
                }

                $this->regenerateCsrfToken();

                if (Reaction::isDebug()) {
                    Reaction::info($log);
                }
                return $this->afterLogin($identity, false, $duration);
            });
    }
public function login(IdentityInterface $identity, $duration = 0)
    {
        //Using root resolve function for promise conversion
        return resolve(true)
            ->then(function() use (&$identity, $duration) {
                return $this->beforeLogin($identity, false, $duration);
            })->then(function() use (&$identity, $duration) {
                $this->switchIdentity($identity, $duration);
                $id = $identity->getId();
                $ip = $this->request->getUserIP();
                if ($this->enableSession) {
                    $log = "User '$id' logged in from $ip with duration $duration.";
                } else {
                    $log = "User '$id' logged in from $ip. Session not enabled.";
                }

                $this->regenerateCsrfToken();

                if (Reaction::isDebug()) {
                    Reaction::info($log);
                }
                return $this->afterLogin($identity, false, $duration);
            });
    }
Logs in a user.

After logging in a user:
- the user's identity information is obtainable from the [[identity]] property

If [[enableSession]] is `true`:
- the identity information will be stored in session and be available in the next requests
- in case of `$duration == 0`: as long as the session remains active or till the user closes the browser
- in case of `$duration > 0`: as long as the session remains active or as long as the cookie
remains valid by it's `$duration` in seconds when [[enableAutoLogin]] is set `true`.

If [[enableSession]] is `false`:
- the `$duration` parameter will be ignored

@param IdentityInterface $identity the user identity (which should already be authenticated)
@param int $duration number of seconds that the user can remain in logged-in status, defaults to `0`
@return ExtendedPromiseInterface with bool whether the user is logged in