infiniflow/ragflow · error · ConnectorMissingCredentialError

Azure Blob

Error message

Azure Blob

What it means

A guard inside validate_connector_settings (and similarly in retrieve_all_slim_docs_perm_sync / _iter_documents) that fires when the stored _container_client is None, i.e. load_credentials never successfully ran or ran in a mode that left no client. The message is just 'Azure Blob', making it the least descriptive error in the connector — it means 'connector used before credentials were loaded'.

Source

Thrown at common/data_source/azure_blob_connector.py:180

                self._container_client = ContainerClient.from_container_url(full_url)
            else:
                raise ConnectorMissingCredentialError(
                    "Azure Blob credentials are incomplete. Provide one of: (a) connection_string + container_name, (b) account_name + account_key + container_name, (c) container_url + sas_token."
                )
        except ConnectorMissingCredentialError:
            raise
        except Exception as exc:
            raise ConnectorMissingCredentialError(f"Failed to initialise Azure Blob client: {exc}") from exc

        return None

    # ------------------------------------------------------------------
    # Validation
    # ------------------------------------------------------------------

    def validate_connector_settings(self) -> None:
        if self._container_client is None:
            raise ConnectorMissingCredentialError("Azure Blob")

        try:
            # get_container_properties() costs one API call; it returns
            # the ETag and last-modified of the container, proving both
            # the credential and the container name are valid.
            self._container_client.get_container_properties()
        except Exception as exc:
            msg = str(exc)
            code = getattr(getattr(exc, "error_code", None), "value", None) or getattr(exc, "error_code", "")
            if "AuthenticationFailed" in msg or "InvalidAuthenticationInfo" in msg:
                raise ConnectorMissingCredentialError(f"Azure Blob credential rejected: {msg[:300]}") from exc
            if "AuthorizationPermissionMismatch" in msg or "403" in msg:
                raise InsufficientPermissionsError(f"Azure Blob: insufficient permissions on container: {msg[:300]}") from exc
            if "ContainerNotFound" in msg or "404" in msg:
                raise ConnectorValidationError(f"Azure Blob: container not found: {msg[:300]}") from exc
            raise UnexpectedValidationError(f"Azure Blob validation failed ({code}): {msg[:300]}") from exc

    # ------------------------------------------------------------------

View on GitHub (pinned to 554fb1133a)

Solutions

1. Ensure load_credentials(credentials) is called and succeeds before validate_connector_settings() or any document iteration
2. Check that load_credentials did not raise earlier — an earlier ConnectorMissingCredentialError was probably swallowed
3. If orchestrating, assert connector._container_client is not None after the load step in debug builds to pinpoint the ordering bug

Example fix

# before
connector = AzureBlobConnector(batch_size=100)
connector.validate_connector_settings()

# after
connector = AzureBlobConnector(batch_size=100)
connector.load_credentials(creds)
connector.validate_connector_settings()

def ensure_loaded(connector) -> None:
    connector.load_credentials(creds)
    if connector._container_client is None:
        raise RuntimeError("load_credentials returned but no client was built")

try:
    connector.validate_connector_settings()
except ConnectorMissingCredentialError:
    # means 'not loaded yet' in this guard — fix the setup order, don't retry
    connector.load_credentials(creds)
    connector.validate_connector_settings()

When it happens

Trigger: Calling validate_connector_settings(), retrieve_all_slim_docs_perm_sync(), or _iter_documents() on a connector instance where load_credentials was never called, failed before assigning _container_client, or was skipped by an orchestration bug.

Common situations: A job runner that constructs the connector and immediately calls validate (assuming construction loads credentials), or a retry path that creates a fresh connector instance but only re-runs part of the setup.

Related errors

• Azure Blob: container_name is required together with account
• Azure Blob: container_url and sas_token are required for the
• Azure Blob credentials are incomplete. Provide one of: (a) c
• BigQuery credentials not loaded.
• Invalid chat_id: ${payload.chat_id}

AI-assisted analysis of infiniflow/ragflow@554fb1133a (2026-08-15). Data as JSON: /api/errors/a1fe605954152a9c. Report an issue: GitHub.