infiniflow/ragflow · error · ConnectorMissingCredentialError

Oracle Cloud Infrastructure

Error message

Oracle Cloud Infrastructure

What it means

Raised by BlobStorageConnector.load_credentials when bucket_type is 'oci' (OCI_STORAGE) but the credentials dict is missing any of the four required keys: namespace, region, access_key_id, secret_access_key. The connector validates presence (truthiness) of each key before creating the S3-compatible client, so empty strings, None, or absent keys all fail. The exception message is just 'Oracle Cloud Infrastructure', identifying which provider's credentials were incomplete.

Source

Thrown at common/data_source/blob_connector.py:111

                    raise ConnectorMissingCredentialError("Amazon S3")

            elif authentication_method == "iam_role":
                if not credentials.get("aws_role_arn"):
                    raise ConnectorMissingCredentialError("Amazon S3 IAM role ARN is required")

            elif authentication_method == "assume_role":
                pass

            else:
                raise ConnectorMissingCredentialError("Unsupported S3 authentication method")

        elif self.bucket_type == BlobType.GOOGLE_CLOUD_STORAGE:
            if not all(credentials.get(key) for key in ["access_key_id", "secret_access_key"]):
                raise ConnectorMissingCredentialError("Google Cloud Storage")

        elif self.bucket_type == BlobType.OCI_STORAGE:
            if not all(credentials.get(key) for key in ["namespace", "region", "access_key_id", "secret_access_key"]):
                raise ConnectorMissingCredentialError("Oracle Cloud Infrastructure")

        elif self.bucket_type == BlobType.S3_COMPATIBLE:
            if not all(credentials.get(key) for key in ["endpoint_url", "aws_access_key_id", "aws_secret_access_key", "addressing_style"]):
                raise ConnectorMissingCredentialError("S3 Compatible Storage")

        else:
            raise ValueError(f"Unsupported bucket type: {self.bucket_type}")

        # Create S3 client
        self.s3_client = create_s3_client(self.bucket_type, credentials, self.european_residency)

        # Detect bucket region (only important for S3)
        if self.bucket_type == BlobType.S3:
            self.bucket_region = detect_bucket_region(self.s3_client, self.bucket_name)

        return None

    def _build_document_from_obj(

View on GitHub (pinned to 554fb1133a)

Solutions

  1. Supply all four credential keys in the connector credential config: namespace, region, access_key_id, secret_access_key
  2. Get the namespace with 'oci os ns get' (or from the OCI console tenancy page) and the region from the console URL/console header
  3. Create a Customer Secret Key (S3-compatible credential) in OCI under Identity > User > Customer Secret Keys if access_key_id/secret_access_key are missing
  4. Verify no credential value is an empty string before calling load_credentials (empty strings fail the truthiness check)

Example fix

// before
connector.load_credentials({
    'access_key_id': key,
    'secret_access_key': secret,
})
// after
connector.load_credentials({
    'namespace': 'my-tenancy-namespace',
    'region': 'us-ashburn-1',
    'access_key_id': key,
    'secret_access_key': secret,
})
Defensive patterns

Strategy: validation

Validate before calling

REQUIRED_OCI = ['namespace', 'region', 'access_key_id', 'secret_access_key']
missing = [k for k in REQUIRED_OCI if not credentials.get(k)]
if missing:
    raise ValueError(f'OCI credentials missing: {missing}')
connector.load_credentials(credentials)

Type guard

def has_oci_credentials(c: dict) -> bool:
    return all(isinstance(c.get(k), str) and c[k].strip() for k in
               ['namespace', 'region', 'access_key_id', 'secret_access_key'])

Try / catch

try:
    connector.load_credentials(creds)
except ConnectorMissingCredentialError as e:
    if 'Oracle' in str(e):
        raise ConfigError('Provide namespace, region, access_key_id, secret_access_key for OCI') from e
    raise

Prevention

When it happens

Trigger: Calling load_credentials({'bucket_type': 'oci', ...}) with a credentials dict lacking 'namespace' or 'region' (the two keys users most often forget, since the access key pair alone is not enough for OCI's S3-compatible endpoint). Also triggered when any of the four values is an empty string '' because the check uses truthiness (credentials.get(key)).

Common situations: Configuring an Onyx/Onyxdotdev blob storage connector for Oracle Cloud Object Storage; user copies AWS-style key/secret but omits the OCI namespace (e.g. 'idxa4bhqvvnh') or home region (e.g. 'us-ashburn-1'); values stored blank in a secrets manager and read back as empty strings.

Related errors

AI-assisted analysis of infiniflow/ragflow@554fb1133a (2026-08-15). Data as JSON: /api/errors/050590cd9d1a22d1. Report an issue: GitHub.