by Sam Stevens.
I assume when you say you look at the database and the passwords are blank you mean the moodle database not the external one.
I'm not sure if it does copy the passwords to moodle. The documentation is a bit unclear on this (for example for LDAP there is an option to cache passwords) so it might only check them on login.
Double and triple check the settings in particular the password field.
Other than that can you make a small duplicate database with just a couple of test users in but no SHA-256 then point to that just to rule that out?