title: Creating a Redshift user with a sha256 password
body: <p>According to the redshift <a href="https://docs.aws.amazon.com/redshift/latest/dg/r_CREATE_USER.html" rel="nofollow noreferrer">CREATE USER</a> documentation, you can create a user and provide their password as a sha256 encrypted string with a salt, for example:</p>
  <pre class="lang-sql prettyprint-override"><code>CREATE USER admin PASSWORD 'sha256|fe95f2bc7c4a111b6f0f7d0b60bfedd1935fb295f8dce1d62708ab8d2f564baf|c721bff5d9042cf541ff7b9d48fa8a6e545c19a763e3710151f9513038b0f6c6';
  </code></pre>
  <p>where the syntax for the PASSWORD portion is:
  <code>'sha256|digest|256-bit-salt'</code></p>
  <p>The documentation is a bit light on details about how exactly to do this and my attempts keep failing. I assume that the 256-bit-salt should either be concatenated to the beginning or end of the plain-text password and then hashed like the following:</p>
  <p>given a 256-bit salt of <code>c721bff5d9042cf541ff7b9d48fa8a6e545c19a763e3710151f9513038b0f6c6</code> and a password of <code>ChangeThisPassword123!</code></p>
  <p>I can create the sha256 digest by running the following in redshift:</p>
  <pre class="lang-sql prettyprint-override"><code>select sha2('ChangeThisPassword123!c721bff5d9042cf541ff7b9d48fa8a6e545c19a763e3710151f9513038b0f6c6', 256);
  </code></pre>
  <p>which gives me a digest of <code>28c73049ec678db8b975a0efd140c60491b6e9b1124fb62dd65c35075e89de0e</code>.</p>
  <p>So I should be able to create a user with the following sql:</p>
  <pre class="lang-sql prettyprint-override"><code>CREATE USER exampleuser PASSWORD 'sha256|28c73049ec678db8b975a0efd140c60491b6e9b1124fb62dd65c35075e89de0e|c721bff5d9042cf541ff7b9d48fa8a6e545c19a763e3710151f9513038b0f6c6';
  </code></pre>
  <p>However, when I try to login as this user with the password <code>ChangeThisPassword123!</code> I get a bad password error!</p>
  <p>Anyone know what I am doing wrong here? I've tried putting the salt at the beginning of the password before creating the digest too but no luck.</p>