According to BOL, the CREATE USER statement is "Requires ALTER ANY USER permission on the database." This will be in addition to having EXECUTE permission on your stored procedure in the database where this code resides and/or is executed. You need to check the permissions required in the database to GRANT CONNECTION and anything else being done within the database. E.g., GRANT EXECUTE minimally requires having CONTROL permission on that object.