Syntax:
CREATE USER user_specification [, user_specification] ...

user_specification:
    user [ identified_option ]

auth_option: {
    IDENTIFIED BY 'auth_string'
  | IDENTIFIED BY PASSWORD 'hash_string'
  | IDENTIFIED WITH auth_plugin
  | IDENTIFIED WITH auth_plugin AS 'hash_string'
}

The CREATE USER statement creates new MySQL accounts. An error occurs
if you try to create an account that already exists.

To use CREATE USER, you must have the global CREATE USER privilege or
the INSERT privilege for the mysql database. When the read_only system
variable is enabled, CREATE USER additionally requires the SUPER
privilege.

For each account, CREATE USER creates a new row in the mysql.user table
with no privileges and (as of MySQL 5.5.7) assigns the account an
authentication plugin. Depending on the syntax used, CREATE USER may
also assign the account a password.

Each user_specification clause consists of an account name and
information about how authentication occurs for clients that use the
account. This part of CREATE USER syntax is shared with GRANT, so the
description here applies to GRANT as well.

Each account name uses the format described in
http://dev.mysql.com/doc/refman/5.5/en/account-names.html. For example:

CREATE USER 'jeffrey'@'localhost' IDENTIFIED BY 'mypass';

If you specify only the user name part of the account name, a host name
part of '%' is used.

The server assigns an authentication plugin and password to each
account as follows, depending on whether the user specification clause
includes IDENTIFIED WITH to specify a plugin or IDENTIFIED BY to
specify a password:

*Note*: IDENTIFIED WITH is available as of MySQL 5.5.7. Before 5.5.7,
authentication plugins are not used, so only the remarks about
IDENTIFIED BY apply.

o With IDENTIFIED WITH, the server assigns the specified plugin and the
  account has no password. If the optional AS 'hash_string' clause is
  also given, the string is stored as is in the authentication_string
  column (it is assumed to be already hashed in the format required by
  the plugin).

o With IDENTIFIED BY, the server assigns no plugin and assigns the
  specified password.

o With neither IDENTIFIED WITH nor IDENTIFIED BY, the server assigns no
  plugin and the account has no password.

If the account has no password, the Password column in the account's
mysql.user table row remains empty, which is insecure. To set the
password, use SET PASSWORD. See [HELP SET PASSWORD].

If the server assigns no plugin to the account, the plugin column in
the account's mysql.user table row remains empty.

For client connections that use a given account, the server invokes the
authentication plugin assigned to the account and the client must
provide credentials as required by the authentication method that the
plugin implements. If the server cannot find the plugin, either at
account-creation time or connect time, an error occurs.

If an account's mysql.user table row has a nonempty plugin column:

o The server authenticates client connection attempts using the named
  plugin.

o Changes to the account password using SET PASSWORD with PASSWORD()
  must be made with the old_passwords system variable set to the value
  required by the authentication plugin, so that PASSWORD() uses the
  appropriate password hashing method. If the plugin is
  mysql_old_password, the password can also be changed using SET
  PASSWORD with OLD_PASSWORD(), which uses pre-4.1 password hashing
  regardless of the value of old_passwords.

If an account's mysql.user table row has an empty plugin column:

o The server authenticates client connection attempts using the
  mysql_native_password or mysql_old_password authentication plugin,
  depending on the hash format of the password stored in the Password
  column.

o Changes to the account password using SET PASSWORD can be made with
  PASSWORD(), with old_passwords set to 0 or 1 for 4.1 or pre-4.1
  password hashing, respectively, or with OLD_PASSWORD(), which uses
  pre-4.1 password hashing regardless of the value of old_passwords.

CREATE USER examples:

o To specify an authentication plugin for an account, use IDENTIFIED
  WITH auth_plugin. The plugin name can be a quoted string literal or
  an unquoted name. 'auth_string' is an optional quoted string literal
  to pass to the plugin. The plugin interprets the meaning of the
  string, so its format is plugin specific and it is stored in the
  authentication_string column as given. (This value is meaningful only
  for plugins that use that column.) Consult the documentation for a
  given plugin for information about the authentication string values
  it accepts, if any.

CREATE USER 'jeffrey'@'localhost' IDENTIFIED WITH mysql_native_password;

  The server assigns the given authentication plugin to the account but
  no password. Clients must provide no password when they connect.
  However, an account with no password is insecure. To ensure that an
  account uses a specific authentication plugin and has a password with
  the corresponding hash format, specify the plugin explicitly with
  IDENTIFIED WITH, then use SET PASSWORD to set the password:

CREATE USER 'jeffrey'@'localhost' IDENTIFIED WITH mysql_native_password;
SET old_passwords = 0;
SET PASSWORD FOR 'jeffrey'@'localhost' = PASSWORD('mypass');

  Changes to the account password using SET PASSWORD with PASSWORD()
  must be made with the old_passwords system variable set to the value
  required by the account's authentication plugin, so that PASSWORD()
  uses the appropriate password hashing method. Therefore, to use the
  mysql_old_password plugin instead, name that plugin in the CREATE
  USER statement and set old_passwords to 1 before using SET PASSWORD.

o To specify a password for an account at account-creation time, use
  IDENTIFIED BY with the literal cleartext password value:

CREATE USER 'jeffrey'@'localhost' IDENTIFIED BY 'mypass';

  The server assigns the given password to the account but no
  authentication plugin. Clients must provide the password when they
  connect.

o To avoid specifying the cleartext password if you know its hash value
  (the value that PASSWORD() would return for the password), specify
  the hash value preceded by the keyword PASSWORD:

CREATE USER 'jeffrey'@'localhost'
IDENTIFIED BY PASSWORD '*90E462C37378CED12064BB3388827D2BA3A9B689';

  The server assigns the given password to the account but no
  authentication plugin. Clients must provide the password when they
  connect.

o To enable the user to connect with no password, include no IDENTIFIED
  BY clause:

CREATE USER 'jeffrey'@'localhost';

  The server assigns no authentication plugin or password to the
  account. Clients must provide no password when they connect. However,
  an account with no password is insecure. To avoid this, use SET
  PASSWORD to set the account password.

For additional information about setting passwords and authentication
plugins, see
http://dev.mysql.com/doc/refman/5.5/en/assigning-passwords.html, and
http://dev.mysql.com/doc/refman/5.5/en/pluggable-authentication.html.

URL: http://dev.mysql.com/doc/refman/5.5/en/create-user.html

