{"record":{"id":"af03974c0f0bf19b","repo":"infiniflow/ragflow","slug":"your-github-token-is-missing-authorization-to-acce","errorCode":null,"errorMessage":"Your GitHub token is missing authorization to access the `{self.repo_owner}` organization. Please follow the guide to authorize your token: {SSO_GUIDE_LINK}","messagePattern":"Your GitHub token is missing authorization to access the `(.+?)` organization\\. Please follow the guide to authorize your token: (.+?)","errorType":"validation","errorClass":"ConnectorValidationError","httpStatus":null,"severity":"error","filePath":"common/data_source/github/connector.py","lineNumber":726,"sourceCode":"                    test_repo = self.github_client.get_repo(f\"{self.repo_owner}/{self.repositories}\")\n                    test_repo.get_contents(\"\")\n            else:\n                # Try to get organization first\n                try:\n                    org = self.github_client.get_organization(self.repo_owner)\n                    total_count = org.get_repos().totalCount\n                    if total_count == 0:\n                        raise ConnectorValidationError(f\"Found no repos for organization: {self.repo_owner}. Does the credential have the right scopes?\")\n                except GithubException as e:\n                    # Check for missing SSO\n                    MISSING_SSO_ERROR_MESSAGE = \"You must grant your Personal Access token access to this organization\".lower()\n                    if MISSING_SSO_ERROR_MESSAGE in str(e).lower():\n                        SSO_GUIDE_LINK = (\n                            \"https://docs.github.com/en/enterprise-cloud@latest/authentication/\"\n                            \"authenticating-with-saml-single-sign-on/\"\n                            \"authorizing-a-personal-access-token-for-use-with-saml-single-sign-on\"\n                        )\n                        raise ConnectorValidationError(\n                            f\"Your GitHub token is missing authorization to access the `{self.repo_owner}` organization. Please follow the guide to authorize your token: {SSO_GUIDE_LINK}\"\n                        )\n                    # If not an org, try as a user\n                    user = self.github_client.get_user(self.repo_owner)\n\n                    # Check if we can access any repos\n                    total_count = user.get_repos().totalCount\n                    if total_count == 0:\n                        raise ConnectorValidationError(f\"Found no repos for user: {self.repo_owner}. Does the credential have the right scopes?\")\n\n        except RateLimitExceededException:\n            raise UnexpectedValidationError(\"Validation failed due to GitHub rate-limits being exceeded. Please try again later.\")\n\n        except GithubException as e:\n            if e.status == 401:\n                raise CredentialExpiredError(\"GitHub credential appears to be invalid or expired (HTTP 401).\")\n            elif e.status == 403:\n                raise InsufficientPermissionsError(\"Your GitHub token does not have sufficient permissions for this repository (HTTP 403).\")","sourceCodeStart":708,"sourceCodeEnd":744,"githubUrl":"https://github.com/infiniflow/ragflow/blob/554fb1133ac3861732235ad9c377eb5e0a770665/common/data_source/github/connector.py#L708-L744","documentation":"ConnectorValidationError raised when get_organization(repo_owner) throws a GithubException whose text contains GitHub's SSO notice ('you must grant your personal access token access to this organization'). SAML/SSO-protected organizations require each PAT to be explicitly authorized; an unauthorized token gets 403 with that message. The error embeds GitHub's official docs link for authorizing a PAT for SAML SSO.","triggerScenarios":"repo_owner is an enterprise org enforcing SAML SSO; the saved PAT has not been granted access to that org, so the API call fails with the SSO banner text, which this except-branch string-matches.","commonSituations":"Company GitHub with SSO enabled; user created a PAT but never clicked 'Configure SSO' / the org's SSO authorization; token regenerated and lost its SSO grant.","solutions":["Open GitHub -> Settings -> Developer settings -> Personal access tokens, then use 'Configure SSO' (or the org's authorization prompt) to grant the token access to the organization.","Follow the SSO guide URL embedded in the error message.","Alternatively use a GitHub App credential, which bypasses per-token SSO grants when installed on the org."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try:\n    connector.validate_connector_settings()\nexcept ConnectorValidationError as e:\n    if 'missing authorization' in str(e):\n        prompt_user_to_authorize_sso(e)  # message already embeds the docs URL","preventionTips":["For SAML-enforced orgs, authorize every new/regenerated PAT via 'Configure SSO' before saving it.","Consider GitHub App credentials, which avoid per-PAT SSO grants once installed by the org."],"tags":["github","sso","saml","permissions","enterprise"],"backgroundTag":null,"analyzedSha":"554fb1133ac3861732235ad9c377eb5e0a770665","analyzedAt":"2026-08-15T09:20:16.380Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}