Reduce string allocations by comparing issuers in-place

CHANGELOG.md

@@ -1,5 +1,11 @@
 See the [releases](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases) for details on bug fixes and added features.
 
+
+Pending Next Release
+=====
+### Bug Fixes:
+- Reduced allocations in `AadIssuerValidator` by not using `string.Replace` where appropriate. See issue [#2595](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/2595) and PR [#2597](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/2597) for more details.
+
 7.6.0
 =====
 ### New Features:

src/Microsoft.IdentityModel.Validators/AadIssuerValidator/AadIssuerValidator.cs

@@ -13,7 +13,6 @@
 using Microsoft.IdentityModel.Protocols;
 using Microsoft.IdentityModel.Protocols.OpenIdConnect;
 using Microsoft.IdentityModel.Tokens;
-using static Microsoft.IdentityModel.Validators.AadIssuerValidator;
 
 namespace Microsoft.IdentityModel.Validators
 {
@@ -388,16 +387,49 @@ private static bool IsValidIssuer(string validIssuerTemplate, string tenantId, s
             if (string.IsNullOrEmpty(validIssuerTemplate))
                 return false;
 
-            if (validIssuerTemplate.Contains(TenantIdTemplate))
+            int indexOfTenantIdTemplate = validIssuerTemplate.IndexOf(TenantIdTemplate, StringComparison.Ordinal);
+            if (indexOfTenantIdTemplate >= 0)
             {
-                return validIssuerTemplate.Replace(TenantIdTemplate, tenantId) == actualIssuer;
+                return IssuersWithTemplatesAreEqual(validIssuerTemplate.AsSpan(), TenantIdTemplate.AsSpan(), indexOfTenantIdTemplate, actualIssuer.AsSpan(), tenantId.AsSpan());
             }
             else
             {
                 return validIssuerTemplate == actualIssuer;
             }
         }
 
+        /// <summary>
+        /// Compare two Issuers with templates without string allocations.
+        /// This function replaces: issuer1.Replace(issuer1Template, tenantId) == issuer2
+        /// Example:
+        ///     issuer1 = "https://login.microsoftonline.com/{tenantid}/v2.0"
+        ///     issuer1Template = "{tenantid}"
+        ///     issuer2 = "https://login.microsoftonline.com/12345678/v2.0"
+        ///     tenantId = "12345678"
+        /// </summary>
+        internal static bool IssuersWithTemplatesAreEqual(ReadOnlySpan<char> issuer1, ReadOnlySpan<char> issuer1Template, int templateStartIndex, ReadOnlySpan<char> issuer2, ReadOnlySpan<char> tenantId)
+        {
+            if (templateStartIndex == -1)
+                return false;
+
+            // ensure the first part of the issuer1 matches the first part of issuer2
+            if (!issuer1.Slice(0, templateStartIndex).SequenceEqual(issuer2.Slice(0, templateStartIndex)))
+                return false;
+
+            // ensure that issuer2 contains the tenantId from templateStartIndex for the length of tenantId.Length
+            if (!issuer2.Slice(templateStartIndex, tenantId.Length).SequenceEqual(tenantId))
+                return false;
+
+            int secondHalfIssuer1StartIndex = templateStartIndex + issuer1Template.Length;
+            int secondHalfIssuer2StartIndex = templateStartIndex + tenantId.Length;
+
+            // ensure the second halves are equal
+            if (!issuer1.Slice(secondHalfIssuer1StartIndex).SequenceEqual(issuer2.Slice(secondHalfIssuer2StartIndex)))
+                return false;
+
+            return true;
+        }
+
         private void SetEffectiveLKGIssuer(string aadIssuer, ProtocolVersion protocolVersion, TimeSpan lastKnownGoodLifetime)
         {
             var issuerLKG = new IssuerLastKnownGood

src/Microsoft.IdentityModel.Validators/AadTokenValidationParametersExtension.cs

@@ -76,31 +76,36 @@ internal static bool ValidateIssuerSigningKey(SecurityKey securityKey, SecurityT
 #if NET6_0_OR_GREATER
                 if (!string.IsNullOrEmpty(tokenIssuer) && !tokenIssuer.Contains(tenantIdFromToken, StringComparison.Ordinal))
                     throw LogHelper.LogExceptionMessage(new SecurityTokenInvalidIssuerException(LogHelper.FormatInvariant(LogMessages.IDX40004, LogHelper.MarkAsNonPII(tokenIssuer), LogHelper.MarkAsNonPII(tenantIdFromToken))));
-
-                // creating an effectiveSigningKeyIssuer is required as signingKeyIssuer might contain {tenantid}
-                var effectiveSigningKeyIssuer = signingKeyIssuer.Replace(AadIssuerValidator.TenantIdTemplate, tenantIdFromToken, StringComparison.Ordinal);
-                var v2TokenIssuer = openIdConnectConfiguration.Issuer?.Replace(AadIssuerValidator.TenantIdTemplate, tenantIdFromToken, StringComparison.Ordinal);
 #else
                 if (!string.IsNullOrEmpty(tokenIssuer) && !tokenIssuer.Contains(tenantIdFromToken))
                     throw LogHelper.LogExceptionMessage(new SecurityTokenInvalidIssuerException(LogHelper.FormatInvariant(LogMessages.IDX40004, LogHelper.MarkAsNonPII(tokenIssuer), LogHelper.MarkAsNonPII(tenantIdFromToken))));
-
-                // creating an effectiveSigningKeyIssuer is required as signingKeyIssuer might contain {tenantid}
-                var effectiveSigningKeyIssuer = signingKeyIssuer.Replace(AadIssuerValidator.TenantIdTemplate, tenantIdFromToken);
-                var v2TokenIssuer = openIdConnectConfiguration.Issuer?.Replace(AadIssuerValidator.TenantIdTemplate, tenantIdFromToken);
 #endif
-
-                // comparing effectiveSigningKeyIssuer with v2TokenIssuer is required as well because of the following scenario:
+                // comparing effectiveSigningKeyIssuer with v2TokenIssuer is required because of the following scenario:
                 // 1. service trusts /common/v2.0 endpoint 
                 // 2. service receieves a v1 token that has issuer like sts.windows.net
                 // 3. signing key issuers will never match sts.windows.net as v1 endpoint doesn't have issuers attached to keys
                 // v2TokenIssuer is the representation of Token.Issuer (if it was a v2 issuer)
-                if (effectiveSigningKeyIssuer != tokenIssuer && effectiveSigningKeyIssuer != v2TokenIssuer)
+                int templateStartIndex = signingKeyIssuer.IndexOf(AadIssuerValidator.TenantIdTemplate, StringComparison.Ordinal);
+                if (!AadIssuerValidator.IssuersWithTemplatesAreEqual(signingKeyIssuer.AsSpan(), AadIssuerValidator.TenantIdTemplate.AsSpan(), templateStartIndex, tokenIssuer.AsSpan(), tenantIdFromToken.AsSpan())
+                        && !AadIssuerValidator.IssuersWithTemplatesAreEqual(signingKeyIssuer.AsSpan(), AadIssuerValidator.TenantIdTemplate.AsSpan(), templateStartIndex, openIdConnectConfiguration.Issuer == null ? [] : openIdConnectConfiguration.Issuer.AsSpan(), tenantIdFromToken.AsSpan()))
+                {
+                    string effectiveSigningKeyIssuer = templateStartIndex > -1 ? CreateIssuer(signingKeyIssuer, AadIssuerValidator.TenantIdTemplate, tenantIdFromToken, templateStartIndex) : signingKeyIssuer;
                     throw LogHelper.LogExceptionMessage(new SecurityTokenInvalidIssuerException(LogHelper.FormatInvariant(LogMessages.IDX40005, LogHelper.MarkAsNonPII(tokenIssuer), LogHelper.MarkAsNonPII(effectiveSigningKeyIssuer))));
+                }
             }
 
             return true;
         }
 
+        internal static string CreateIssuer(string issuer, string tenantIdTemplate, string tenantId, int templateStartIndex)
+        {
+#if NET6_0_OR_GREATER
+            return string.Concat(issuer.AsSpan(0, templateStartIndex), tenantId, issuer.AsSpan(templateStartIndex + tenantIdTemplate.Length, issuer.Length - tenantIdTemplate.Length - templateStartIndex));
+#else
+            return string.Concat(issuer.Substring(0, templateStartIndex), tenantId, issuer.Substring(templateStartIndex + tenantIdTemplate.Length));
+#endif
+        }
+
         /// <summary>
         /// Validates the issuer signing key certificate.
         /// </summary>

test/Microsoft.IdentityModel.Validators.Tests/AadIssuerValidatorTests.cs

@@ -0,0 +1,46 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+using System;
+using Xunit;
+
+namespace Microsoft.IdentityModel.Validators.Tests
+{
+    public class AadIssuerValidatorTests
+    {
+        [Fact]
+        public static void IssuersWithTemplatesAreEqualTests_EqualIssuers()
+        { 
+            // arrange
+            var issuer1Template = "{tenantId}";
+            var issuer1 = ValidatorConstants.AadInstance + issuer1Template;
+            var issuer2Template = ValidatorConstants.TenantIdAsGuid;
+            var issuer2 = ValidatorConstants.AadInstance + issuer2Template;
+            int templateStartIndex = issuer1.IndexOf(issuer1Template);
+
+            // act
+            var result = AadIssuerValidator.IssuersWithTemplatesAreEqual(
+                issuer1.AsSpan(), issuer1Template.AsSpan(), templateStartIndex, issuer2.AsSpan(), issuer2Template.AsSpan());
+
+            // assert
+            Assert.True(result);
+        }
+
+        [Fact]
+        public static void IssuersWithTemplatesAreEqualTests_UnequalIssuers()
+        {
+            // arrange
+            var issuer1Template = "{tenantId}";
+            var issuer1 = ValidatorConstants.AadInstancePPE + issuer1Template;
+            var issuer2Template = ValidatorConstants.TenantIdAsGuid;
+            var issuer2 = ValidatorConstants.AadInstance + issuer2Template;
+            int templateStartIndex = issuer1.IndexOf(issuer1Template);
+
+            // act
+            var result = AadIssuerValidator.IssuersWithTemplatesAreEqual(
+                issuer1.AsSpan(), issuer1Template.AsSpan(), templateStartIndex, issuer2.AsSpan(), issuer2Template.AsSpan());
+
+            // assert
+            Assert.False(result);
+        }
+    }
+}

test/Microsoft.IdentityModel.Validators.Tests/AadSigningKeyIssuerValidatorTests.cs

@@ -325,6 +325,21 @@ public static TheoryData<AadSigningKeyIssuerTheoryData> ValidateIssuerSigningKey
             }
         }
 
+        [Fact]
+        public static void CreateIssuer_ReturnsExpectedIssuer()
+        {
+            // arrange
+            var issuerTemplate = "{tenantId}";
+            var issuer = ValidatorConstants.AadInstance + issuerTemplate;
+            int templateStartIndex = issuer.IndexOf(issuerTemplate);
+
+            // act
+            var result = AadTokenValidationParametersExtension.CreateIssuer(issuer, issuerTemplate, ValidatorConstants.TenantIdAsGuid, templateStartIndex);
+
+            // assert
+            Assert.Equal(ValidatorConstants.AadInstance + ValidatorConstants.TenantIdAsGuid, result);
+        }
+
         private static OpenIdConnectConfiguration GetConfigurationMock()
         {
             var config = new OpenIdConnectConfiguration();