infiniflow/ragflow · error · ConnectorMissingCredentialError

Azure Blob: container_name is required together with account

Error message

Azure Blob: container_name is required together with account_name + account_key

What it means

Raised by RAGFlow's Azure Blob connector when the account_key auth mode is selected but container_name is empty. The connector needs a container to build a ContainerClient from the BlobServiceClient, so it refuses to initialize without one. It is a ConnectorMissingCredentialError, meaning the credential payload itself is incomplete rather than rejected by Azure.

Source

Thrown at common/data_source/azure_blob_connector.py:148

                mode = "connection_string"
            elif account_name and account_key:
                mode = "account_key"
            elif container_url and sas_token:
                mode = "sas_token"

        try:
            if mode == "connection_string":
                if not conn_str:
                    raise ConnectorMissingCredentialError("Azure Blob: connection_string is required for the connection_string auth mode")
                if not container_name:
                    raise ConnectorMissingCredentialError("Azure Blob: container_name is required together with connection_string")
                svc = BlobServiceClient.from_connection_string(conn_str)
                self._container_client = svc.get_container_client(container_name)
            elif mode == "account_key":
                if not (account_name and account_key):
                    raise ConnectorMissingCredentialError("Azure Blob: account_name and account_key are required for the account_key auth mode")
                if not container_name:
                    raise ConnectorMissingCredentialError("Azure Blob: container_name is required together with account_name + account_key")
                account_url = f"https://{account_name}.{_AZURE_ENDPOINT_SUFFIX}"
                svc = BlobServiceClient(
                    account_url=account_url,
                    credential=account_key,
                )
                self._container_client = svc.get_container_client(container_name)
            elif mode == "sas_token":
                if not (container_url and sas_token):
                    raise ConnectorMissingCredentialError("Azure Blob: container_url and sas_token are required for the sas_token auth mode")
                # mirrors RAGFlowAzureSasBlob; strip a leading "?" so we
                # never produce a double-"?" that breaks SAS auth.
                normalized_sas = str(sas_token).lstrip("?")
                full_url = f"{container_url}?{normalized_sas}"
                self._container_client = ContainerClient.from_container_url(full_url)
            else:
                raise ConnectorMissingCredentialError(
                    "Azure Blob credentials are incomplete. Provide one of: (a) connection_string + container_name, (b) account_name + account_key + container_name, (c) container_url + sas_token."
                )

View on GitHub (pinned to 554fb1133a)

Solutions

Add 'container_name': '<your-container>' to the same credentials dict that holds account_name and account_key
Check for typos/empty-string values in the credential payload (e.g. container_name set to '')
If you intended SAS auth, supply container_url + sas_token instead; if connection-string auth, supply connection_string + container_name

Example fix

// before
creds = {
  "account_name": "myaccount",
  "account_key": "<key>",
}
connector.load_credentials(creds)

// after
creds = {
  "account_name": "myaccount",
  "account_key": "<key>",
  "container_name": "my-container",
}
connector.load_credentials(creds)

Defensive patterns

Strategy: validation

Validate before calling

def validate_azure_account_key_creds(creds: dict) -> None:
    mode = creds.get("auth_mode") or _infer_mode(creds)
    if mode == "account_key":
        missing = [k for k in ("account_name", "account_key", "container_name") if not creds.get(k)]
        if missing:
            raise ValueError(f"account_key mode missing: {missing}")

Type guard

def is_complete_account_key_creds(c: dict) -> bool:
    return all(
        isinstance(c.get(k), str) and c[k].strip()
        for k in ("account_name", "account_key", "container_name")
    )

Try / catch

try:
    connector.load_credentials(creds)
except ConnectorMissingCredentialError as e:
    # surface to user as a config form error, not a crash
    raise ConfigError(str(e)) from e

Prevention

Validate the credential dict shape (keys present, non-empty strings) before calling load_credentials
Keep a single helper that builds Azure credential dicts so all call sites agree on key names
Add a unit test that asserts load_credentials succeeds for each supported auth-mode fixture

When it happens

Trigger: Calling load_credentials (directly or via connector startup) with credentials where auth mode resolves to 'account_key' (account_name + account_key present) but the 'container_name' key is missing, empty, or None. Note the mode check at the top of load_credentials decides the branch before this raise fires.

Common situations: Typo in the credential key ('container' vs 'container_name'), UI form that stores container in a separate field never merged into the credential dict, or copy-pasting only the account name/key pair from the Azure portal without the container.

Related errors

AI-assisted analysis of infiniflow/ragflow@554fb1133a (2026-08-15). Data as JSON: /api/errors/18db9e8a63a3efda. Report an issue: GitHub.