IKEv2 mutual authentication step I read from here that,
https://tools.ietf.org/html/rfc7296
it mentioned,
2.15.  Authentication of the IKE SA
the initiator
signs the first message (IKE_SA_INIT request), starting with the
first octet of the first SPI in the header and ending with the last
octet of the last payload.  Appended to this (for purposes of
computing the signature) are the responder's nonce Nr, and the value
prf(SK_pi, IDi').  It is critical to the security of the exchange
that each side sign the other side's nonce.
from part one(IKE_SA_INIT request), we have Ni, then we append Nr,
why we need to append the third part: prf(SK_pi, IDi') and then sign the msg?
why just signing Ni and Nr is not enough?
why just signing Ni and Nr is not enough?

Because we want to make sure that man-in-the-middle can modify (or hijack) the initial messages without being detected.
Consider this attack:

Alice sends an IKE_SA_INIT request to Bob

Mallet intercepts that message; he forwards his own IKE_SA_INIT message to Bob, using Alice's Ni value, but his own KE payload

Bob replies with an IKE_SA_RESP message, which his Nr value.

Mallet intercepts that message; he forwards his own IKE_SA_RESP message to Alice, using Bob's Nr value, but his own KE payload


Essentially, Mallet is establishing two separate IKE connections, one with Alice and one with Bob.
Alice then authenticates herself; if she just signed the Ni, Nr values she saw, Mallet could just resend that signature to Bob (which saw the exact same Ni, Nr) values, and so Bob would assume he's talking to Alice.
By appending the prf(SK_pi, IDi') value, this is not possible (because Alice and Bob don't have the same SK_pi value)