There are two ways to log any password - I do not see any problem with either of them.
1. Not log any password, just log the user.
2. Log '******' against the password. logger.info("User=" + user + "logged with Password=******");
Do we have any best practices for these situations?
What is the point of logging '**' in the log? It's just extra text that takes up space and doesn't provide any information. Just leave it out.
As long as no information about the password is saved, anything is fine.
I think that the existence of a password should be logged so that in the future someone could read the logs and find out how a user logged in. (password, OID e.t.c.)
Depending on your DB structure, there is no real purpose of logging the password they logged in with, because it can be inferred that if the logged in, then the used the current password :)
If you have a history of password changes (and obviously, storing the password in a hashed format so it can't be reversed anyway) you can rely on this system completely, to determine, if for some reason it's ever required, that they did indeed use password X, that they had between Date FOO and Date BAR.
Anyway, the point is, user X logged in. is all that really needs to be logged.
Don't bother. Logging asterisks is hazardous if your masked password includes the same number of stars as the length of the password -- you're giving information about the password away by doing that. The alternative is to always log a different number of asterisks, but when you resort to doing that, is there really a point?
Don't log the passwords or ***. If you want to know different methods of authentication, then categorise these and log those accordingly.
I fail to see why logging the password or *** would be of any benefit: in fact logging the password is a complete no-no and security risk.
In the first place, why would you want such thing?
I think there are some more options (from more to less secure)
do not log password
for the purpose to identify among some known passwords list do log cryptographically strong hash of password using e.g. MD5/SHA1. Storing number of asterisks is a form if this one, but less secure.
to recover password do log encrypted one using e.g. AES.
log plain text password.