[Bug] Authentication audit logs expose request signatures

[Aias00]

Problem

DefaultAuthenticationProvider.doAuditLog() writes the raw request signature into authentication audit logs for both failed and successful authentication attempts:

log.info("[AUTHENTICATION] User:{} is authenticated failed with Signature = {}.", context.getUsername(), context.getSignature());
log.debug("[AUTHENTICATION] User:{} is authenticated success with Signature = {}.", context.getUsername(), context.getSignature());

Signatures are security-sensitive authentication material and should not be emitted verbatim to logs.

Impact

Operators may persist raw authentication signatures in log aggregation systems, increasing credential-related exposure risk during authentication failures or debug logging.

Expected behavior

Authentication audit logs should preserve useful diagnostics, but redact or summarize signatures instead of printing the raw value.

Code evidence

• auth/src/main/java/org/apache/rocketmq/auth/authentication/provider/DefaultAuthenticationProvider.java

Suggested fix

Mask the signature before logging, and add tests covering both short and long signatures.