ServerSPN Property is ignored from the target connection string

Environment Details

• SqlPackage or DacFx Version: Tested 162.3.566 and latest version 162.5.57
• .NET Core: .Net 8.0
• OS: Windows & Linux (WSL)
• Target SQL Server Version: SQL Server 2022 CU11 on Linux (It should not be related)

---

Description

The ServerSPN parameter is being ignored from the connection string when passed to sqlpackage or Microsoft.SqlServer.Dac.DacServices. This prevents explicit Kerberos authentication using a custom SPN.

According to the Microsoft.Data.SqlClient.SqlConnection.ConnectionString documentation, ServerSPN is a valid parameter, but it is stripped out when processed by DacFx.

---

Steps to Reproduce

1. Using sqlpackage

sqlpackage /Action:script \
/SourceFile:"/source_path/file.dacpac" \
/OutputPath:"/output_path/file.sql" \
/TargetConnectionString:"myserver.domain.com,1433;Initial Catalog=mydb;TrustServerCertificate=true;ServerSPN=MSSQLSvc/customspn.domain.com;Integrated Security=True;"

Expected: SQL Server should authenticate using the provided ServerSPN.
Actual: ServerSPN is ignored, and Kerberos falls back to default SPN resolution.

---

2. Using Microsoft.SqlServer.Dac.DacServices in C#

using Microsoft.SqlServer.Dac;
using Microsoft.Data.SqlClient;

SqlConnectionStringBuilder builder = new()
{
    DataSource = "myserver.domain.com,1433",
    InitialCatalog = "mydb",
    Encrypt = SqlConnectionEncryptOption.Optional,
    TrustServerCertificate = true,
    IntegratedSecurity = true,
    ServerSPN = "MSSQLSvc/customspn.domain.com",
};
var dacServices = new DacServices(connectionString);

Expected: Authentication uses the explicit ServerSPN.
Actual: ServerSPN is stripped from the connection string.
I used Visual Studio debugger to see the internal values of the dacServices object and I saw that the ServerSPN was trimmed from the connection string.

---

Impact

• Prevents manual SPN specification for Kerberos authentication.

---

Expected Behavior

• ServerSPN should not be removed from the connection string.
• Kerberos authentication should correctly use the explicitly provided SPN.

---

Reproduce the issue with the sqlpackage command and the C# DacServices example, then trace where DacFx processes the target connection string. Done means the explicit ServerSPN remains in the connection string and Kerberos authentication uses that value.