infiniflow/ragflow · error · ConnectorValidationError

Your GitHub token is missing authorization to access the `{s

Error message

Your GitHub token is missing authorization to access the `{self.repo_owner}` organization. Please follow the guide to authorize your token: {SSO_GUIDE_LINK}

What it means

ConnectorValidationError raised when get_organization(repo_owner) throws a GithubException whose text contains GitHub's SSO notice ('you must grant your personal access token access to this organization'). SAML/SSO-protected organizations require each PAT to be explicitly authorized; an unauthorized token gets 403 with that message. The error embeds GitHub's official docs link for authorizing a PAT for SAML SSO.

Source

Thrown at common/data_source/github/connector.py:726

                    test_repo = self.github_client.get_repo(f"{self.repo_owner}/{self.repositories}")
                    test_repo.get_contents("")
            else:
                # Try to get organization first
                try:
                    org = self.github_client.get_organization(self.repo_owner)
                    total_count = org.get_repos().totalCount
                    if total_count == 0:
                        raise ConnectorValidationError(f"Found no repos for organization: {self.repo_owner}. Does the credential have the right scopes?")
                except GithubException as e:
                    # Check for missing SSO
                    MISSING_SSO_ERROR_MESSAGE = "You must grant your Personal Access token access to this organization".lower()
                    if MISSING_SSO_ERROR_MESSAGE in str(e).lower():
                        SSO_GUIDE_LINK = (
                            "https://docs.github.com/en/enterprise-cloud@latest/authentication/"
                            "authenticating-with-saml-single-sign-on/"
                            "authorizing-a-personal-access-token-for-use-with-saml-single-sign-on"
                        )
                        raise ConnectorValidationError(
                            f"Your GitHub token is missing authorization to access the `{self.repo_owner}` organization. Please follow the guide to authorize your token: {SSO_GUIDE_LINK}"
                        )
                    # If not an org, try as a user
                    user = self.github_client.get_user(self.repo_owner)

                    # Check if we can access any repos
                    total_count = user.get_repos().totalCount
                    if total_count == 0:
                        raise ConnectorValidationError(f"Found no repos for user: {self.repo_owner}. Does the credential have the right scopes?")

        except RateLimitExceededException:
            raise UnexpectedValidationError("Validation failed due to GitHub rate-limits being exceeded. Please try again later.")

        except GithubException as e:
            if e.status == 401:
                raise CredentialExpiredError("GitHub credential appears to be invalid or expired (HTTP 401).")
            elif e.status == 403:
                raise InsufficientPermissionsError("Your GitHub token does not have sufficient permissions for this repository (HTTP 403).")

View on GitHub (pinned to 554fb1133a)

Solutions

Open GitHub -> Settings -> Developer settings -> Personal access tokens, then use 'Configure SSO' (or the org's authorization prompt) to grant the token access to the organization.
Follow the SSO guide URL embedded in the error message.
Alternatively use a GitHub App credential, which bypasses per-token SSO grants when installed on the org.

Defensive patterns

Strategy: try-catch

Try / catch

try:
    connector.validate_connector_settings()
except ConnectorValidationError as e:
    if 'missing authorization' in str(e):
        prompt_user_to_authorize_sso(e)  # message already embeds the docs URL

Prevention

For SAML-enforced orgs, authorize every new/regenerated PAT via 'Configure SSO' before saving it.
Consider GitHub App credentials, which avoid per-PAT SSO grants once installed by the org.

When it happens

Trigger: repo_owner is an enterprise org enforcing SAML SSO; the saved PAT has not been granted access to that org, so the API call fails with the SSO banner text, which this except-branch string-matches.

Common situations: Company GitHub with SSO enabled; user created a PAT but never clicked 'Configure SSO' / the org's SSO authorization; token regenerated and lost its SSO grant.

Related errors

AI-assisted analysis of infiniflow/ragflow@554fb1133a (2026-08-15). Data as JSON: /api/errors/af03974c0f0bf19b. Report an issue: GitHub.