How to generate password_hash for RabbitMQ Management HTTP API
<p>The beloved <a href="https://www.rabbitmq.com/management.html" rel="noreferrer">RabbitMQ Management Plugin</a> has a <a href="https://raw.githack.com/rabbitmq/rabbitmq-management/rabbitmq_v3_6_6/priv/www/api/index.html" rel="noreferrer">HTTP API</a> to manage the RabbitMQ through plain HTTP requests.</p>

<p>We need to create users programatically, and the HTTP API was the chosen way to go. The documentation is scarce, but the API it's pretty simple and intuitive. </p>

<p>Concerned about the security, we don't want to pass the user password in plain text, and the API offers a field to send the password hash instead. Quote from there:</p>

<blockquote>
  <p>[ GET | PUT | DELETE ] /api/users/<em>name</em></p>
  
  <p>An individual user. To PUT a user, you will need a body looking
  something like this:</p>

<pre><code>{"password":"secret","tags":"administrator"}
</code></pre>
  
  <p>or:</p>

<pre><code>{"password_hash":"2lmoth8l4H0DViLaK9Fxi6l9ds8=", "tags":"administrator"}
</code></pre>
  
  <p>The tags key is mandatory. Either <code>password</code> or <code>password_hash</code> must be set.</p>
</blockquote>

<p>So far, so good, the problem is: <strong>how to correctly generate the <code>password_hash</code>?</strong> </p>

<p>The <a href="https://www.rabbitmq.com/passwords.html" rel="noreferrer">password hashing algorithm</a> is configured in RabbitMQ's configuration file, and our is configured as the default SHA256.</p>

<p>I'm using C#, and the following code to generate the hash:</p>

<pre><code>var cr = new SHA256Managed();
var simplestPassword = "1";
var bytes = cr.ComputeHash(Encoding.UTF8.GetBytes(simplestPassword));
var sb = new StringBuilder();
foreach (var b in bytes) sb.Append(b.ToString("x2"));
var hash = sb.ToString();
</code></pre>

<p>This doesn't work. Testing in some online tools for SHA256 encryption, the code is generating the expected output. However, if we go to the management page and set the user password manually to "1" then it works like a charm.</p>

<p><a href="https://stackoverflow.com/a/40280532/3136474">This answer</a> led me to export the configurations and take a look at the hashes RabbitMQ are generating, and I realized a few things:</p>

<ul>
<li>hash example of "1": "y4xPTRVfzXg68sz9ALqeQzARam3CwnGo53xS752cDV5+Utzh"</li>
<li>all the user's hashes have fixed length</li>
<li>the hashes change every time (even if the password is the same). I know PB2K also do this to passwords, but don't know the name of this cryptographic property.</li>
<li>if I pass the <code>password_hash</code> the RabbitMQ stores it without changes</li>
</ul>

<p>I'm accepting suggestions in another programming languages as well, not just C#.</p>