infiniflow/ragflow · error · ConnectorMissingCredentialError

Oracle Cloud Infrastructure

Error message

Oracle Cloud Infrastructure

What it means

Raised by BlobStorageConnector.load_credentials when bucket_type is 'oci' (OCI_STORAGE) but the credentials dict is missing any of the four required keys: namespace, region, access_key_id, secret_access_key. The connector validates presence (truthiness) of each key before creating the S3-compatible client, so empty strings, None, or absent keys all fail. The exception message is just 'Oracle Cloud Infrastructure', identifying which provider's credentials were incomplete.

Solutions

  1. Supply all four credential keys in the connector credential config: namespace, region, access_key_id, secret_access_key
  2. Get the namespace with 'oci os ns get' (or from the OCI console tenancy page) and the region from the console URL/console header
  3. Create a Customer Secret Key (S3-compatible credential) in OCI under Identity > User > Customer Secret Keys if access_key_id/secret_access_key are missing
  4. Verify no credential value is an empty string before calling load_credentials (empty strings fail the truthiness check)

Example fix

// before
connector.load_credentials({
    'access_key_id': key,
    'secret_access_key': secret,
})
// after
connector.load_credentials({
    'namespace': 'my-tenancy-namespace',
    'region': 'us-ashburn-1',
    'access_key_id': key,
    'secret_access_key': secret,
})
Defensive patterns

Strategy: validation

Validate before calling

REQUIRED_OCI = ['namespace', 'region', 'access_key_id', 'secret_access_key']
missing = [k for k in REQUIRED_OCI if not credentials.get(k)]
if missing:
    raise ValueError(f'OCI credentials missing: {missing}')
connector.load_credentials(credentials)

Type guard

def has_oci_credentials(c: dict) -> bool:
    return all(isinstance(c.get(k), str) and c[k].strip() for k in
               ['namespace', 'region', 'access_key_id', 'secret_access_key'])

Try / catch

try:
    connector.load_credentials(creds)
except ConnectorMissingCredentialError as e:
    if 'Oracle' in str(e):
        raise ConfigError('Provide namespace, region, access_key_id, secret_access_key for OCI') from e
    raise

Prevention

When it happens

Trigger: Calling load_credentials({'bucket_type': 'oci', ...}) with a credentials dict lacking 'namespace' or 'region' (the two keys users most often forget, since the access key pair alone is not enough for OCI's S3-compatible endpoint). Also triggered when any of the four values is an empty string '' because the check uses truthiness (credentials.get(key)).

Common situations: Configuring an Onyx/Onyxdotdev blob storage connector for Oracle Cloud Object Storage; user copies AWS-style key/secret but omits the OCI namespace (e.g. 'idxa4bhqvvnh') or home region (e.g. 'us-ashburn-1'); values stored blank in a secrets manager and read back as empty strings.

Related errors

AI-assisted analysis of infiniflow/ragflow@554fb1133a (2026-08-15). Data as JSON: /api/errors/050590cd9d1a22d1. Report an issue: GitHub.

Appendix: source

Thrown at common/data_source/blob_connector.py:111

                    raise ConnectorMissingCredentialError("Amazon S3")

            elif authentication_method == "iam_role":
                if not credentials.get("aws_role_arn"):
                    raise ConnectorMissingCredentialError("Amazon S3 IAM role ARN is required")

            elif authentication_method == "assume_role":
                pass

            else:
                raise ConnectorMissingCredentialError("Unsupported S3 authentication method")

        elif self.bucket_type == BlobType.GOOGLE_CLOUD_STORAGE:
            if not all(credentials.get(key) for key in ["access_key_id", "secret_access_key"]):
                raise ConnectorMissingCredentialError("Google Cloud Storage")

        elif self.bucket_type == BlobType.OCI_STORAGE:
            if not all(credentials.get(key) for key in ["namespace", "region", "access_key_id", "secret_access_key"]):
                raise ConnectorMissingCredentialError("Oracle Cloud Infrastructure")

        elif self.bucket_type == BlobType.S3_COMPATIBLE:
            if not all(credentials.get(key) for key in ["endpoint_url", "aws_access_key_id", "aws_secret_access_key", "addressing_style"]):
                raise ConnectorMissingCredentialError("S3 Compatible Storage")

        else:
            raise ValueError(f"Unsupported bucket type: {self.bucket_type}")

        # Create S3 client
        self.s3_client = create_s3_client(self.bucket_type, credentials, self.european_residency)

        # Detect bucket region (only important for S3)
        if self.bucket_type == BlobType.S3:
            self.bucket_region = detect_bucket_region(self.s3_client, self.bucket_name)

        return None

    def _build_document_from_obj(

View on GitHub (pinned to 554fb1133a)