infiniflow/ragflow · error · ConnectorMissingCredentialError

Azure Blob: account_name and account_key are required for th

Error message

Azure Blob: account_name and account_key are required for the account_key auth mode

What it means

ConnectorMissingCredentialError from the account_key branch of the Azure Blob connector (common/data_source/azure_blob_connector.py:143-150). account_key auth requires the pair account_name + account_key (the connector builds https://{account_name}.{endpoint_suffix} and passes account_key as the credential); if either half is missing the connector fails fast rather than calling the SDK with partial credentials. The same branch additionally requires container_name.

Source

Thrown at common/data_source/azure_blob_connector.py:146

        if not mode:
            if conn_str:
                mode = "connection_string"
            elif account_name and account_key:
                mode = "account_key"
            elif container_url and sas_token:
                mode = "sas_token"

        try:
            if mode == "connection_string":
                if not conn_str:
                    raise ConnectorMissingCredentialError("Azure Blob: connection_string is required for the connection_string auth mode")
                if not container_name:
                    raise ConnectorMissingCredentialError("Azure Blob: container_name is required together with connection_string")
                svc = BlobServiceClient.from_connection_string(conn_str)
                self._container_client = svc.get_container_client(container_name)
            elif mode == "account_key":
                if not (account_name and account_key):
                    raise ConnectorMissingCredentialError("Azure Blob: account_name and account_key are required for the account_key auth mode")
                if not container_name:
                    raise ConnectorMissingCredentialError("Azure Blob: container_name is required together with account_name + account_key")
                account_url = f"https://{account_name}.{_AZURE_ENDPOINT_SUFFIX}"
                svc = BlobServiceClient(
                    account_url=account_url,
                    credential=account_key,
                )
                self._container_client = svc.get_container_client(container_name)
            elif mode == "sas_token":
                if not (container_url and sas_token):
                    raise ConnectorMissingCredentialError("Azure Blob: container_url and sas_token are required for the sas_token auth mode")
                # mirrors RAGFlowAzureSasBlob; strip a leading "?" so we
                # never produce a double-"?" that breaks SAS auth.
                normalized_sas = str(sas_token).lstrip("?")
                full_url = f"{container_url}?{normalized_sas}"
                self._container_client = ContainerClient.from_container_url(full_url)
            else:
                raise ConnectorMissingCredentialError(

View on GitHub (pinned to 554fb1133a)

Solutions

Supply both account_name (storage account name, e.g. 'mystorageacct') and account_key (one of the two access keys) in the connector config.
If secrets come from environment/secret-manager, verify both resolved to non-empty values before the connector runs.
If you actually have a SAS token or connection string, switch auth_mode to sas_token or connection_string and provide those fields instead.

Example fix

# before
{"auth_mode": "account_key", "account_name": "mystorageacct", "account_key": ""}
# after
{"auth_mode": "account_key", "account_name": "mystorageacct", "account_key": "<access-key>", "container_name": "docs"}

Defensive patterns

Strategy: validation

Validate before calling

if cfg.get("auth_mode") == "account_key" or (cfg.get("account_name") and cfg.get("account_key")):
    if not (cfg.get("account_name") and cfg.get("account_key")):
        raise ValueError("account_key mode requires both account_name and account_key")
    if not cfg.get("container_name"):
        raise ValueError("account_key mode also requires container_name")

Type guard

def azure_account_key_mode_complete(cfg: dict) -> bool:
    return bool(cfg.get("account_name")) and bool(cfg.get("account_key")) and bool(cfg.get("container_name"))

Try / catch

from common.data_source.azure_blob_connector import ConnectorMissingCredentialError
try:
    connector.connect()
except ConnectorMissingCredentialError as e:
    if "account_name and account_key" in str(e):
        raise RuntimeError("Azure data source misconfigured: provide account_name + account_key (+ container_name)") from e
    raise

Prevention

Copy both the storage account name and one of its two access keys — they are a pair.
If using secret references, assert both resolve to non-empty before connector creation.
Match auth_mode to the credentials you actually have (key vs SAS vs connection string).

When it happens

Trigger: Data source config resolving to auth mode account_key (explicit auth_mode, or inferred from account_name+account_key) where account_name or account_key is empty/None — e.g. only the key was pasted, or only the account name, or a secret reference failed to resolve leaving account_key blank.

Common situations: Pasting the storage account key but forgetting the account name field; environment-based secrets where one variable is undefined; renaming accounts without updating config; misreading the Azure portal keys blade.

Related errors

AI-assisted analysis of infiniflow/ragflow@554fb1133a (2026-08-15). Data as JSON: /api/errors/601f4dd7ec360db5. Report an issue: GitHub.