RANGER-5693: Stop logging full JWT bearer tokens on validation failure

[ramackri]

Summary

• Remove logging of the full serialized JWT bearer token (header.payload.signature) when RangerJwtAuthHandler validation fails.
• Log only non-sensitive metadata: subject, audience, issuer, keyId, jwtId.

JIRA: https://issues.apache.org/jira/browse/RANGER-5693

Problem

On validation failure, RangerJwtAuthHandler.authenticate() logged:

RangerJwtAuthHandler.authenticate(): Validation failed for JWT token: [<full serialized JWT>]

validateToken() checks claims in order: expiration → signature → audience → issuer. A cryptographically valid, unexpired token rejected only for audience mismatch still hit this WARN path. The full bearer credential in logs could be replayed against another Ranger JWT consumer that trusts the same signing material and accepts the token's audience.

Fix

Before:

LOG.warn("... Validation failed for JWT token: [{}] ", jwtToken.serialize());

After:

LOG.warn("JWT validation failed ({})", safeJwtLogContext(jwtToken));

safeJwtLogContext() emits diagnostic fields only, for example:

JWT validation failed (subject=f015_replay_user, audience=service-a, issuer=test-issuer, keyId=kid-abc, jwtId=jti-123)

The raw bearer string is never written to operational logs. jwtId (jti claim) provides log correlation when present.

Null-safety

• validateAudiences(): guard tokenAudienceList != null before iterating (avoids NPE when aud claim is absent).
• safeJwtLogContext(): guard jwtToken.getHeader() before reading keyId; use StringUtils.join() for audience list (JDK 8 compatible, tolerates null list entries).

Files changed (2)

File	Change
ranger-authn/.../RangerJwtAuthHandler.java	Safe logging, safeJwtLogContext(), audience null guard
ranger-authn/.../TestRangerJwtAuthHandler.java	Unit tests for safe context and missing audience

Test plan

Unit tests (automated)

mvn -pl ranger-authn test -Dtest=TestRangerJwtAuthHandler
mvn verify -pl ranger-authn -Dtest=TestRangerJwtAuthHandler -Drat.skip=true