Avoid unintended SPN generation for non-integrated authentication on native SNI path (#3929)

This PR fixes a connection performance regression introduced by PR #2790,
where SPN generation could be triggered for non-integrated authentication
modes such as SQL authentication on the native SNI path. This change ensures
that SPN generation is only triggered when authentication mode is integrated
security (SSPI/Kerberos).

Author: apoorvdeshmukh

src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/TdsParserStateObjectNative.windows.cs

@@ -155,20 +155,8 @@ internal override void CreatePhysicalSNIHandle(
             string hostNameInCertificate,
             string serverCertificateFilename)
         {
-            if (isIntegratedSecurity)
-            {
-                // now allocate proper length of buffer
-                if (!string.IsNullOrEmpty(serverSPN))
-                {
-                    // Native SNI requires the Unicode encoding and any other encoding like UTF8 breaks the code.
-                    SqlClientEventSource.Log.TryTraceEvent("<sc.TdsParser.Connect|SEC> Server SPN `{0}` from the connection string is used.", serverSPN);
-                }
-                else
-                {
-                    // Empty signifies to interop layer that SPN needs to be generated
-                    serverSPN = string.Empty;
-                }
-            }
+            // Normalize SPN based on authentication mode
+            serverSPN = NormalizeServerSpn(serverSPN, isIntegratedSecurity);
 
             ConsumerInfo myInfo = CreateConsumerInfo(async);
 
@@ -183,7 +171,44 @@ internal override void CreatePhysicalSNIHandle(
                 transparentNetworkResolutionState, totalTimeout,
 #endif
                 iPAddressPreference, cachedDNSInfo, hostNameInCertificate);
-            resolvedSpn = new(serverSPN.TrimEnd());
+
+            // Only produce resolvedSpn when we actually have one.
+            if (!string.IsNullOrWhiteSpace(serverSPN))
+            {
+                resolvedSpn = new(serverSPN.TrimEnd());
+            }
+            else
+            {
+                resolvedSpn = default;
+            }
+        }
+
+        /// <summary>
+        /// Normalizes the serverSPN based on authentication mode.
+        /// </summary>
+        /// <param name="serverSPN">The server SPN value from the connection string.</param>
+        /// <param name="isIntegratedSecurity">Indicates whether integrated security (SSPI) is being used.</param>
+        /// <returns>
+        /// For integrated security: returns <paramref name="serverSPN"/> if provided, otherwise <see cref="string.Empty"/> to trigger SPN generation.
+        /// For SQL auth: returns <see langword="null"/> if <paramref name="serverSPN"/> is empty (no generation), otherwise returns the provided value.
+        /// </returns>
+        internal static string NormalizeServerSpn(string serverSPN, bool isIntegratedSecurity)
+        {
+            if (isIntegratedSecurity)
+            {
+                if (string.IsNullOrWhiteSpace(serverSPN))
+                {
+                    // Empty signifies to interop layer that SPN needs to be generated
+                    return string.Empty;
+                }
+
+                // Native SNI requires the Unicode encoding and any other encoding like UTF8 breaks the code.
+                SqlClientEventSource.Log.TryTraceEvent("<sc.TdsParser.Connect|SEC> Server SPN `{0}` from the connection string is used.", serverSPN);
+                return serverSPN;
+            }
+
+            // For SQL auth (and other non-SSPI modes), null means "No SPN generation".
+            return string.IsNullOrWhiteSpace(serverSPN) ? null : serverSPN;
         }
 
         protected override uint SniPacketGetData(PacketHandle packet, byte[] _inBuff, ref uint dataSize)

src/Microsoft.Data.SqlClient/tests/UnitTests/Microsoft/Data/SqlClient/TdsParserStateObjectNativeTests.cs

@@ -0,0 +1,34 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+#if NETFRAMEWORK || WINDOWS
+
+using Xunit;
+
+namespace Microsoft.Data.SqlClient.UnitTests
+{
+    public class TdsParserStateObjectNativeTests
+    {
+        [Theory]
+        [InlineData(null, true, "")]           // Integrated + null -> empty (generate SPN)
+        [InlineData("", true, "")]             // Integrated + empty -> empty (generate SPN)
+        [InlineData(" ", true, "")]             // Integrated + whitespace -> empty (generate SPN)
+        [InlineData("MSSQLSvc/host", true, "MSSQLSvc/host")] // Integrated + provided -> use it
+        [InlineData(null, false, null)]        // SQL Auth + null -> null (no generation)
+        [InlineData("", false, null)]          // SQL Auth + empty -> null (no generation)
+        [InlineData(" ", false, null)]          // SQL Auth + whitespace -> null (no generation)
+        [InlineData("MSSQLSvc/host", false, "MSSQLSvc/host")] // SQL Auth + provided -> use it
+        [PlatformSpecific(TestPlatforms.Windows)]
+        public void NormalizeServerSpn_ReturnsExpectedValue(
+            string? inputSpn,
+            bool isIntegratedSecurity,
+            string? expectedSpn)
+        {
+            string? result = TdsParserStateObjectNative.NormalizeServerSpn(inputSpn, isIntegratedSecurity);
+            Assert.Equal(expectedSpn, result);
+        }
+    }
+}
+
+#endif